Transformers Regular Expression Denial of Service (ReDoS) vulnerability

中 6.5CVE-2025-1194 · GHSA-fpwr-67px-3qhx · PYSEC-2026-1984 · 29/04/2025 公開 · 17/06/2026 更新

要点

CVE-2025-1194 は transformers, transformers (huggingface) に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.49%（全脆弱性の 42.3% より高い）。
対処：4.50.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
transformers PyPI	`< 4.50.0`	`4.50.0`
transformers huggingface	`< 4.50.0`	`4.50.0`

概要

A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file tokenization_gpt_neox_japanese.py of the GPT-NeoX-Japanese model. The vulnerability occurs in the SubWordJapaneseTokenizer class, where regular expressions process specially crafted inputs. The issue stems from a regex exhibiting exponential complexity under certain conditions, leading to excessive backtracking. This can result in high CPU usage and potential application downtime, effectively creating a Denial of Service (DoS) scenario. The affected version is v4.48.1 (latest).

NVD の説明

A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file `tokenization_gpt_neox_japanese.py` of the GPT-NeoX-Japanese model. The vulnerability occurs in the SubWordJapaneseTokenizer class, where regular expressions process specially crafted inputs. The issue stems from a regex exhibiting exponential complexity under certain conditions, leading to excessive backtracking. This can result in high CPU usage and potential application downtime, effectively creating a Denial of Service (DoS) scenario. The affected version is v4.48.1 (latest).