Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2024-12720: huggingface/transformers: Malicious Input Can Cause High CPU Usage
CVE-2024-12720 · published 1 year ago
Summary
A malicious input can cause the huggingface/transformers library to use an excessive amount of CPU time, potentially leading to application downtime. This issue affects version v4.46.3 and later. To fix this, update to a newer version of the library.
What to do
- Update the hugging face team (past and future) with the help of all our contributors (https://github.com/huggingface/transformers/graphs/contributors) transformers to version 4.48.0.
- Update huggingface transformers to version 4.48.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | the hugging face team (past and future) with the help of all our contributors (https://github.com/huggingface/transformers/graphs/contributors) | transformers |
< 4.48.0 Fix: upgrade to 4.48.0
|
| – | huggingface | transformers |
< 4.48.0 cpe:2.3:a:huggingface:transformers:*:*:*:*:*:*:*:* |
Original advisory text
Regular Expression Denial of Service (ReDoS) in huggingface/transformers
A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file tokenization_nougat_fast.py. The vulnerability occurs in the post_process_single() function, where a regular expression processes specially crafted input. The issue stems from the regex exhibiting exponential time complexity under certain conditions, leading to excessive backtracking. This can result in significantly high CPU usage and potential application downtime, effectively creating a Denial of Service (DoS) scenario. The affected version is v4.46.3 (latest).
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-12720 Vendor Advisory
- https://github.com/huggingface/transformers/commit/deac971c469bcbb182c2e52da0b82... Patch
- https://github.com/advisories/GHSA-6rvg-6v2m-4j46
- https://huntr.com/bounties/4bed1214-7835-4252-a853-22bbad891f98 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/12xxx/CVE-2024-12720... Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-1333Inefficient Regular Expression Complexity (ReDoS)
Timeline
Published20 Mar 2025
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta