CVE-2024-12720

What it actually does

This is a Regular Expression Denial of Service vulnerability in the Hugging Face transformers library, affecting version 4.46.3 in tokenization_nougat_fast.py. The vulnerable post_process_single() function applies a regular expression to tokenizer output in a way that can trigger catastrophic backtracking when processing specially crafted input. An attacker who can cause an application to process malicious Nougat tokenizer input can force excessive CPU consumption, long request processing times, worker starvation, and application-level denial of service. The flaw does not directly provide code execution, data disclosure, or privilege escalation; its primary impact is availability loss.

Why it matters to the business

Applications that expose document parsing, OCR, ML inference, model-serving, or user-supplied text processing workflows using the affected transformers Nougat tokenizer may become slow or unavailable when given crafted input. Operational consequences can include API outages, failed jobs, queue backlogs, autoscaling cost increases, degraded customer-facing services, and missed processing SLAs. The issue is not listed in CISA KEV, is not known to be used in ransomware campaigns, and has a low EPSS score, so broad exploitation pressure appears limited; however, any internet-facing or multi-tenant service that processes untrusted input through this code path should still treat it as an availability risk.

How an attack unfolds

An attacker first identifies an application endpoint, batch-processing workflow, or model-serving API that accepts user-controlled content and uses Hugging Face transformers 4.46.3 with the Nougat fast tokenizer. The attacker submits input shaped to interact poorly with the vulnerable regular expression in post_process_single(). When the application invokes the tokenizer post-processing routine, the regex engine performs excessive backtracking with exponential time behavior. This pins CPU on the worker handling the request or job. Repeated requests or concurrent submissions can exhaust available workers, increase latency, cause timeouts, and potentially make the service unavailable. Because the vulnerability is computational rather than memory-corruption based, exploitation generally leaves signs of high CPU usage, request timeouts, and repeated processing of unusually structured input rather than malware artifacts.

How to fix it

Upgrade the affected Hugging Face transformers code to a version that includes the upstream fix, specifically commit deac971c469bcbb182c2e52da0b82fb3bf54cccf or a released package version containing that commit. If immediate upgrade is not possible, mitigate by restricting access to endpoints that invoke Nougat tokenization, enforcing request size and complexity limits, applying strict processing timeouts around tokenizer execution, using worker-level CPU/time isolation, rate-limiting untrusted callers, queueing expensive jobs with concurrency controls, and rejecting anomalous or excessively long inputs before they reach the tokenizer. Rebuild and redeploy containers, serverless packages, model-serving images, and offline job runners that vendor or pin transformers 4.46.3.

How to confirm the fix worked

Confirm that dependency inventories, lockfiles, container images, and runtime environments no longer use transformers 4.46.3 or vulnerable source containing the old tokenization_nougat_fast.py implementation. Verify that the installed source includes commit deac971c469bcbb182c2e52da0b82fb3bf54cccf or a later equivalent fix. Run software composition analysis against application repositories and built artifacts, not only source manifests. In staging, execute a regression test that exercises Nougat tokenizer post-processing with long and adversarially structured input and confirm bounded execution time, no sustained CPU spike, and correct timeout behavior. Also validate compensating controls such as rate limits, request body limits, and job execution timeouts on routes or workers that process untrusted input.

Typical attack path

1. Locate an application, API, or processing pipeline that accepts user-supplied text or documents and uses the Hugging Face transformers Nougat fast tokenizer.
2. Submit crafted input designed to trigger worst-case regular expression behavior during tokenizer post-processing.
3. Cause post_process_single() in tokenization_nougat_fast.py to spend excessive CPU time on regex backtracking.
4. Repeat or parallelize submissions to consume worker capacity and create request timeouts or job backlog.
5. Sustain the traffic until the affected service becomes degraded or unavailable.

How to detect it

There are no public indications in the provided data of active exploitation, named threat actors, ransomware use, or KEV listing. To determine whether exploitation has already occurred, review application access logs, API gateway logs, job queue records, model-serving telemetry, APM traces, container metrics, and host process metrics for periods of unexplained CPU saturation or request timeouts involving document parsing, OCR, Nougat, or transformers-based tokenization. Look for repeated requests with unusually large, repetitive, or malformed text payloads; high processing duration in tokenizer or preprocessing spans; worker processes consuming near-100% CPU without corresponding GPU utilization; elevated 408, 429, 499, 500, 502, 503, or 504 responses; and queue backlogs caused by long-running preprocessing tasks. In Python logs and traces, search for references to tokenization_nougat_fast.py, post_process_single(), NougatTokenizerFast, and regex processing timeouts. Since this is a denial-of-service issue, useful forensic artifacts are performance and request-pattern anomalies rather than persistent files, command execution, registry changes, or network beacons.

• transformers==4.46.3
• tokenization_nougat_fast.py
• post_process_single
• NougatTokenizerFast
• huggingface/transformers
• deac971c469bcbb182c2e52da0b82fb3bf54cccf
• TimeoutError
• ReadTimeout
• 504 Gateway Timeout
• 503 Service Unavailable
• worker timeout
• CPU throttling
• exceeded maximum execution time

What your security team should do

• Inventory all services, notebooks, batch jobs, containers, and model-serving systems that use Hugging Face transformers, especially version 4.46.3 and Nougat tokenizer functionality.
• Prioritize remediation for internet-facing, partner-facing, or multi-tenant systems that process untrusted documents or text through transformers.
• Upgrade to a transformers build containing commit deac971c469bcbb182c2e52da0b82fb3bf54cccf or a later fixed release, then rebuild and redeploy affected artifacts.
• Add execution timeouts, request size limits, rate limits, and worker isolation around ML preprocessing and tokenization paths that handle untrusted input.
• Monitor for sustained CPU saturation, request timeout spikes, worker restarts, and repeated expensive tokenizer invocations from the same source or workload.
• Create detection logic for excessive latency or CPU usage correlated with endpoints or jobs that invoke Nougat tokenization.
• If suspicious activity is observed, preserve application logs, request metadata, job payload metadata where legally permissible, container metrics, and process telemetry for incident review.