{"data":{"id":"d766c8b1-37a5-40cd-b145-b2242923314f","title":"CVE-2025-2099: A vulnerability in the `preprocess_string()` function of the `transformers.testing_utils` module in…","summary":"CVE-2025-2099 affects the `preprocess_string()` function in the `transformers.testing_utils` module of huggingface/transformers version v4.48.3. A regular expression that processes code blocks in docstrings contains nested quantifiers, causing exponential backtracking on input with many newline characters. An attacker can send a specially crafted payload to drive up CPU usage and cause a Denial of Service.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-2099","publishedAt":"2025-05-19T16:15:19.640Z","cveId":"CVE-2025-2099","cweIds":["CWE-1333"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["transformers@< 4.50.0 (fixed: 4.50.0)"],"affectedPackageNames":["transformers"],"affectedPackageRefs":["pypi:transformers"],"affectedVendors":["HuggingFace"],"affectedVendorsRaw":["huggingface/transformers v4.48.3","transformers.testing_utils"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"transformers preprocess_string ReDoS through crafted docstring input","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00608,"epssCheckedAt":"2026-11-04T18:09:13.788Z","kevDateAdded":null,"advisoryAliases":["GHSA-qq3j-4f4f-9583"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:53:47.225Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-03-21T13:40:18.450Z","daysToFix":-59,"fixCheckedAt":"2026-10-29T21:44:31.380Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"transformers","fixedVersion":"4.50.0","matchedVersion":"4.50.0","fixReleasedAt":"2025-03-21T13:40:18.450Z","daysToFix":-59,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:44:31.228Z"}]}}