Regular Expression Denial of Service (ReDoS) in huggingface/transformers

Vulnerability

Analysis

The vulnerability is a Regular Expression Denial of Service (ReDoS) in the preprocess_string() function of the transformers.testing_utils module in Hugging Face Transformers version v4.48.3 [1][2]. The root cause is a complex regular expression with nested quantifiers used to process code blocks within docstrings. This pattern causes exponential backtracking when processing input containing a large number of newline characters [2][4]. The advisory database entry (PYSEC-2025-40) confirms the issue was present in this specific version [3].

Exploitation

An attacker can exploit this by providing a specially crafted payload to any component that uses preprocess_string(). This function is part of the testing utilities, so exploitation likely requires the application to process docstrings or test inputs containing a malicious string with numerous newlines. No authentication is mentioned as required, suggesting the attack surface could be broad if untrusted input reaches the function [2][4]. The exploitation does not require network access beyond delivering the payload.

Impact

Successful exploitation causes high CPU usage and potential application downtime, resulting in a Denial of Service (DoS) scenario [2]. No data confidentiality or integrity impact is described; the attack is purely on availability. The CVSS score is not provided in the references, but the severity is considered due to the potential for resource exhaustion [2].

Mitigation

A patch has been proposed and merged via Pull Request #36648, which cleans up the regex by removing overly complex non-capturing groups, removing unnecessary flags, and simplifying the pattern to avoid exponential runtime [4]. Users are advised to update to a fixed version (likely v4.49.0 or later) or apply the patch manually. There is no mention of the vulnerability being exploited in the wild or being added to CISA's KEV list.