CVE-2024-12720: Regular Expression Denial of Service (ReDoS) in huggingface/transformers
First published: Thu Mar 20 2025(Updated: )
A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file tokenization_nougat_fast.py. The vulnerability occurs in the post_process_single() function, where a regular expression processes specially crafted input. The issue stems from the regex exhibiting exponential time complexity under certain conditions, leading to excessive backtracking. This can result in significantly high CPU usage and potential application downtime, effectively creating a Denial of Service (DoS) scenario. The affected version is v4.46.3 (latest).
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Hugging Face | ||
| pip/transformers | <4.48.0 | 4.48.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-12720?
CVE-2024-12720 is classified as a Regular Expression Denial of Service (ReDoS) vulnerability.
How do I fix CVE-2024-12720?
To fix CVE-2024-12720, update the huggingface/transformers library to the latest version where the vulnerability has been addressed.
What specific function is affected by CVE-2024-12720?
CVE-2024-12720 affects the post_process_single() function in the tokenization_nougat_fast.py file.
What library is impacted by CVE-2024-12720?
CVE-2024-12720 impacts the huggingface/transformers library.
What type of attack can be executed due to CVE-2024-12720?
CVE-2024-12720 allows attackers to perform a Denial of Service (DoS) by exploiting the vulnerable regular expression.
- agent/title
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/author
- agent/severity
- collector/nvd-api
- source/NVD
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-6rvg-6v2m-4j46
- alias/CVE-2024-12720
- collector/nvd-cve
- agent/references
- agent/source
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/github-advisory
- vendor/hugging face
- canonical/hugging face
- package-manager/pip