Transformers Regular Expression Denial of Service (ReDoS) vulnerability

TRUNG BÌNH 6.5CVE-2025-1194 · GHSA-fpwr-67px-3qhx · PYSEC-2026-1984 · Công bố 29/04/2025 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2025-1194 là lỗ hổng mức TRUNG BÌNH (CVSS 6.5) ảnh hưởng transformers, transformers (huggingface).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.49%, cao hơn 42.3% các lỗ hổng khác.
Cách xử lý: cập nhật lên 4.50.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
transformers PyPI	`< 4.50.0`	`4.50.0`
transformers huggingface	`< 4.50.0`	`4.50.0`

Mô tả

A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file tokenization_gpt_neox_japanese.py of the GPT-NeoX-Japanese model. The vulnerability occurs in the SubWordJapaneseTokenizer class, where regular expressions process specially crafted inputs. The issue stems from a regex exhibiting exponential complexity under certain conditions, leading to excessive backtracking. This can result in high CPU usage and potential application downtime, effectively creating a Denial of Service (DoS) scenario. The affected version is v4.48.1 (latest).

Mô tả của NVD

A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file `tokenization_gpt_neox_japanese.py` of the GPT-NeoX-Japanese model. The vulnerability occurs in the SubWordJapaneseTokenizer class, where regular expressions process specially crafted inputs. The issue stems from a regex exhibiting exponential complexity under certain conditions, leading to excessive backtracking. This can result in high CPU usage and potential application downtime, effectively creating a Denial of Service (DoS) scenario. The affected version is v4.48.1 (latest).