CVE-2025-2099: Hugging Face Transformers Regular Expression Denial of Service
A Regular Expression Denial of Service (ReDoS) exists in the preprocessstring() function of the transformers.testingutils module. In versions before 4.50.0, the regex used to process code blocks in docstrings contains nested quantifiers that can trigger catastrophic backtracking when given inputs with many newline characters.
Published May 19, 2025 · Updated Sep 25, 2025
Affected packages
transformers
- Ecosystem
- PyPI
- Affected
- < 4.50.0
- Fixed in
- 4.50.0
- Check
pip show transformers
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
A Regular Expression Denial of Service (ReDoS) exists in the preprocess_string() function of the transformers.testing_utils module. In versions before 4.50.0, the regex used to process code blocks in docstrings contains nested quantifiers that can trigger catastrophic backtracking when given inputs with many newline characters. An attacker who can supply such input to preprocess_string() (or code paths that call it) can force excessive CPU usage and degrade availability.
Fix: released in 4.50.0, which rewrites the regex to avoid the inefficient pattern. ([GitHub][1])
- Affected:
< 4.50.0 - Patched:
4.50.0
Credited to cai0duque.
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-2099
- https://github.com/huggingface/transformers/commit/8cb522b4190bd556ce51be04942720650b1a3e57
- https://huntr.com/bounties/97b780f3-ffca-424f-ad5d-0e1c57a5bde4
- https://github.com/huggingface/transformers/pull/36648
- https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2025-40.yaml
- https://github.com/advisories/GHSA-qq3j-4f4f-9583
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Transformers vulnerabilities
All Transformers entriesCVE-2026-80047
Hugging Face Transformers downloads custom generation code before trust consent
high7.8No fixSep 1, 2026CVE-2026-9856
Transformers save_pretrained path traversal allows arbitrary file writes through chat template names
high7.1Aug 2, 2026CVE-2026-5241
huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path
high8.0Jun 3, 2026CVE-2026-4372
HuggingFace transformers vulnerable to remote code execution
high7.8May 26, 2026CVE-2026-1839
HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class
medium6.5Apr 7, 2026CVE-2025-6921
Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer
medium5.3Sep 23, 2025