CVE-2025-2099: Regular Expression Denial of Service (ReDoS) in huggingface/transformers

Published May 19, 2025
·
Updated

A vulnerability in the preprocessstring() function of the transformers.testingutils module in huggingface/transformers version v4.48.3 allows for a Regular Expression Denial of Service (ReDoS) attack. The regular expression used to process code blocks in docstrings contains nested quantifiers, leading to exponential backtracking when processing input with a large number of newline characters. An attacker can exploit this by providing a specially crafted payload, causing high CPU usage and potential application downtime, effectively resulting in a Denial of Service (DoS) scenario.

Affected Software

3 affected componentsFixes available
Hugging Face Transformers
huggingface transformers<=4.48.3
pip/transformers<4.50.0
4.50.0

Event History

May 19, 2025
CVE Published
via MITRE·11:22 AM
Data Sourced
via MITRE·11:22 AM
DescriptionSeverityWeakness
Data Sourced
via Red Hat·12:01 PM
DescriptionSeverityAffected Software
Advisory Published
via GitHub·12:30 PM
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-2099?

The severity of CVE-2025-2099 is classified as moderate due to its potential for causing a Denial of Service through regular expressions.

2

How do I fix CVE-2025-2099?

To fix CVE-2025-2099, update the Hugging Face transformers library to a version that patches the vulnerability.

3

Which version of Hugging Face transformers is affected by CVE-2025-2099?

CVE-2025-2099 affects Hugging Face transformers version v4.48.3.

4

What type of attack does CVE-2025-2099 allow?

CVE-2025-2099 allows for a Regular Expression Denial of Service (ReDoS) attack.

5

Where is the vulnerable function located in Hugging Face transformers for CVE-2025-2099?

The vulnerable function for CVE-2025-2099 is located in the `preprocess_string()` function of the `transformers.testing_utils` module.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203