CVE-2025-1194: huggingface transformers

csirt@kutim:~/threat-intel/cve/CVE-2025-1194

CVSS 6.5 · Medium EPSS 0,48%

Kerentanan Inefficient Regular Expression Complexity pada huggingface transformers. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file `tokenization_gpt_neox_japanese.py` of the GPT-NeoX-Japanese model. The vulnerability occurs in the SubWordJapaneseTokenizer class, where regular expressions process specially crafted inputs. The issue stems from a regex exhibiting exponential complexity under certain conditions, leading to excessive backtracking. This can result in high CPU usage and potential application downtime, effectively creating a Denial of Service (DoS) scenario. The affected version is v4.48.1 (latest).

Rincian

Terbit di NVD: 29 April 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-1333: Inefficient Regular Expression Complexity
EPSS (30 hari): 0,48% peluang dieksploitasi; lebih tinggi dari 39,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
huggingface	transformers	Semua versi sebelum 4.50.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/huggingface/transformers/commit/92c5ca9dd70de3ade2af2eb835c96215cc50e815 patch
https://huntr.com/bounties/86f58dcd-683f-4adc-a735-849f51e9abb2 exploit · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.