CVE-2026-85670: tokenizers BpeBuilder Buffer Overflow via merge token

Published Sep 4, 2026
·
Updated

tokenizers (Hugging Face) is affected by an out-of-bounds buffer access in BpeBuilder::build (tokenizers/src/models/bpe/model.rs). When loading a tokenizer.json via Tokenizer::fromfile/fromstr, the builder sizes a scratch buffer to the longest vocabulary key, then writes each concatenated merge rule into it. A merge whose concatenated token exceeds the longest vocabulary key overruns the buffer, which Rust turns into a panic that aborts the process in Rust and FFI embeddings. This occurs at load time with no encoding required, so an attacker who supplies a crafted tokenizer.json can cause a denial of service. A secondary defect at the same location can cause a usize underflow (panic in debug, potential memory corruption in release) when continuingsubwordprefix is set and a merge token is shorter than the prefix. Observed in version 0.23.1.

Affected Software

1 affected component
tokenizers=0.23.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade tokenizers to a version that resolves this vulnerability.

    Fixed in 0.23.1Patch tokenizers BpeBuilder Buffer Overflow via merge token

Event History

Sep 4, 2026
CVE Published
via MITRE·02:32 PM
Data Sourced
via MITRE·02:32 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

What attacker-controlled input is required to trigger the issue?

An attacker must be able to supply a crafted tokenizer.json that the application loads through Tokenizer::from_file or Tokenizer::from_str. No encoding operation is required; the failure occurs while loading the tokenizer.

2

What is the practical impact in Rust and embedded use cases?

The out-of-bounds buffer access is converted by Rust into a panic that aborts the process, including in FFI embeddings, causing denial of service. A related condition involving continuing_subword_prefix and a shorter merge token panics in debug builds and may result in memory corruption in release builds.

3

How can I determine whether a tokenizer file is likely to trigger the primary condition?

Inspect merge rules in the tokenizer.json and compare each concatenated merge token with the longest vocabulary key. A concatenated merge token longer than every vocabulary key can overrun the scratch buffer during BPE model construction.

4

What configuration condition triggers the secondary defect?

The secondary defect requires continuing_subword_prefix to be set and a merge token shorter than that prefix. Under those conditions, length calculation can underflow.

5

Which version has been observed to be affected?

The issue was observed in tokenizers version 0.23.1.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203