CVE-2025-2099

What it actually does

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the `preprocess_string()` function of the `transformers.testing_utils` module. A specially crafted regular expression with nested quantifiers exhibits exponential backtracking when processing strings containing a large number of newline characters. This causes the CPU to reach 100% utilization for a single process, effectively blocking the execution thread and preventing it from handling other tasks, leading to a denial of service.

Why it matters to the business

Exploitation of this vulnerability can lead to a denial of service, causing applications and services that use the vulnerable `huggingface/transformers` library to become slow, unresponsive, or crash entirely. Given the widespread use of this library in AI and machine learning applications, the potential impact is significant, leading to service downtime, negative customer experience, and potential revenue loss. The high CVSS score of 7.5 underscores the severity of the potential disruption.

How an attack unfolds

An attacker identifies a web application or API that uses a vulnerable version of the `huggingface/transformers` library. The attacker then finds an input vector that passes user-supplied data to the `preprocess_string` function. By submitting a specially crafted string, for example, one containing a large number of newline characters, the attacker triggers the ReDoS condition. The server-side regex engine enters a state of catastrophic backtracking, consuming an entire CPU core and rendering the application process unresponsive to legitimate users' requests, thus achieving a denial of service.

How to fix it

The primary remediation is to upgrade the `huggingface/transformers` library to a version that patches this vulnerability (a version later than v4.48.3). If an immediate upgrade is not possible, consider the following mitigations: 1) Implement strict input validation to limit the length and character patterns (e.g., number of consecutive newlines) of strings passed to any function from this library. 2) As a best practice, avoid exposing functions from testing utilities like `testing_utils` to untrusted, user-controlled input in production environments.

How to confirm the fix worked

To validate the fix, confirm that all instances of the `huggingface/transformers` library have been upgraded to a patched version. This can be verified by running `pip list | grep transformers` or using a software composition analysis (SCA) tool to scan your environment's dependencies. To test for vulnerability, you can create a proof-of-concept script in a non-production environment that calls the `preprocess_string` function with a malicious string (e.g., a string with 50+ newline characters) and monitor for a CPU spike. Absence of a CPU spike indicates the patch is effective.

Typical attack path

1. The attacker identifies a target application utilizing a vulnerable version of the `huggingface/transformers` library.
2. The attacker discovers an exposed endpoint or function that accepts user-provided strings and passes them to the `preprocess_string` function.
3. The attacker crafts a simple string payload containing a large quantity of newline characters.
4. The attacker sends this payload to the application, triggering the vulnerable regular expression.
5. The application server's CPU usage spikes to 100% for the affected process, causing a denial of service for all users of the application.

How to detect it

To detect potential exploitation, monitor for sustained and abnormally high CPU utilization on servers running applications with the `huggingface/transformers` library. Correlate these CPU spikes with inbound application or web server logs to identify requests containing unusual payloads, specifically those with a large number of newline characters. Application Performance Monitoring (APM) tools may reveal processes or threads stuck in the `preprocess_string` function. Review system and application logs for crashes, restarts, or health check failures that coincide with high CPU events.

• REGEX_LOG_SEARCH: Look for an excessive number of newline characters in request bodies or API parameters, e.g., using a regex like `\n{20,}`

What your security team should do

• Use a Software Composition Analysis (SCA) tool to immediately identify all applications and systems using vulnerable versions of the `huggingface/transformers` library (v4.48.3 and earlier).
• Prioritize upgrading the library to the latest stable version on all affected systems, focusing first on internet-facing and business-critical applications.
• If patching cannot be performed immediately, apply input validation at the application layer to sanitize and limit the length of strings passed to the library.
• Configure monitoring and alerting for sustained high CPU utilization on hosts running applications dependent on this library to detect potential exploitation attempts.