CVE-2024-12720: Regular Expression Denial of Service (ReDoS) in huggingface/transformers
A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file tokenizationnougatfast.py. The vulnerability occurs in the postprocesssingle() function, where a regular expression processes specially crafted input. The issue stems from the regex exhibiting exponential time complexity under certain conditions, leading to excessive backtracking. This can result in significantly high CPU usage and potential application downtime, effectively creating a Denial of Service (DoS) scenario. The affected version is v4.46.3 (latest).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12720?
CVE-2024-12720 is classified as a Regular Expression Denial of Service (ReDoS) vulnerability.
How do I fix CVE-2024-12720?
To fix CVE-2024-12720, update the huggingface/transformers library to the latest version where the vulnerability has been addressed.
What specific function is affected by CVE-2024-12720?
CVE-2024-12720 affects the post_process_single() function in the tokenization_nougat_fast.py file.
What library is impacted by CVE-2024-12720?
CVE-2024-12720 impacts the huggingface/transformers library.
What type of attack can be executed due to CVE-2024-12720?
CVE-2024-12720 allows attackers to perform a Denial of Service (DoS) by exploiting the vulnerable regular expression.