CVE-2025-1194: Huggingface Transformers DoS Vulnerability

CVE-2025-1194 Overview

CVE-2025-1194 is a Regular Expression Denial of Service (ReDoS) vulnerability in the huggingface/transformers library. The flaw resides in tokenization_gpt_neox_japanese.py within the SubWordJapaneseTokenizer class of the GPT-NeoX-Japanese model. A regex pattern exhibits exponential complexity when processing specially crafted inputs, triggering catastrophic backtracking. This condition drives sustained CPU exhaustion and can render dependent applications unresponsive. The affected version is v4.48.1. The weakness is classified under [CWE-1333] Inefficient Regular Expression Complexity.

Critical Impact
Attackers can submit crafted text inputs to any application performing tokenization with the GPT-NeoX-Japanese tokenizer, triggering CPU exhaustion and denial of service across ML inference pipelines.

Affected Products

HuggingFace Transformers v4.48.1 (latest at time of disclosure)
GPT-NeoX-Japanese model tokenizer (tokenization_gpt_neox_japanese.py)
GPTSan-Japanese tokenizer (tokenization_gptsan_japanese.py)

Discovery Timeline

2025-04-29 - CVE-2025-1194 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1194

Vulnerability Analysis

The vulnerability affects the SubWordJapaneseTokenizer class used by the GPT-NeoX-Japanese model. Regular expressions in this tokenizer process user-supplied text before model inference. When a crafted input matches specific patterns, the regex engine enters catastrophic backtracking, consuming CPU cycles at exponential rates relative to input length.

Any HuggingFace Transformers deployment exposing the affected tokenizer to untrusted input is at risk. This includes public inference endpoints, chatbots, and text preprocessing pipelines. A single request with a short crafted string can stall a worker thread for extended periods, degrading throughput or halting the service entirely.

Root Cause

The root cause is a poorly constructed regular expression with ambiguous alternation and nested quantifiers. Such patterns force the regex engine to explore an exponential number of matching paths on non-matching or partially matching inputs. The underlying weakness is [CWE-1333] Inefficient Regular Expression Complexity.

Attack Vector

Exploitation requires network access to an application that invokes the vulnerable tokenizer on attacker-controlled input. The attacker submits a specially crafted payload through any interface reaching the tokenizer — an API endpoint, form field, or message queue consumer. No authentication is required in typical deployments, though user interaction may be needed to route the input to the tokenizer.

python

# Security patch from upstream commit 92c5ca9dd70de3ade2af2eb835c96215cc50e815
# Fix exploitable regexes in Nougat and GPTSan/GPTJNeoXJapanese (#36121)
# File: src/transformers/models/gpt_neox_japanese/tokenization_gpt_neox_japanese.py
 import json
 import os
 import re
+import sys
 from typing import Optional, Tuple

 import numpy as np

Source: HuggingFace Transformers commit 92c5ca9

The patch rewrites the vulnerable regex constructs to eliminate exponential backtracking. Refer to the Huntr Bounty Report for full technical details of the exploitation pattern.

Detection Methods for CVE-2025-1194

Indicators of Compromise

Sustained single-core CPU utilization at or near 100% on Python worker processes running Transformers.
Inference request latencies climbing from milliseconds to seconds or timing out entirely.
Repeated identical or similar unusual Japanese text payloads arriving from a single source IP.
Stack traces or profiler output showing prolonged execution inside re module functions called by SubWordJapaneseTokenizer.

Detection Strategies

Instrument tokenizer calls with timing telemetry and alert when execution exceeds a defined threshold, such as 500ms per request.
Log the length and entropy of inputs reaching the tokenizer to identify anomalous payloads.
Perform software composition analysis (SCA) to inventory hosts running huggingface/transformers at version v4.48.1 or earlier.

Monitoring Recommendations

Monitor request-to-response latency distributions on ML inference endpoints for sudden tail-latency growth.
Track per-request CPU consumption inside inference workers using APM tooling.
Correlate spikes in worker CPU with source IPs and payload characteristics in the Singularity Data Lake to identify coordinated ReDoS attempts.

How to Mitigate CVE-2025-1194

Immediate Actions Required

Upgrade huggingface/transformers to a version containing commit 92c5ca9dd70de3ade2af2eb835c96215cc50e815 or later.
Audit deployed models for use of GPTNeoXJapanese and GPTSanJapanese tokenizers and prioritize those endpoints for patching.
Enforce request timeouts on tokenizer and inference calls to bound worst-case CPU consumption per request.

Patch Information

The upstream fix is available in the HuggingFace Transformers commit 92c5ca9, which addresses exploitable regexes in the Nougat, GPTSan-Japanese, and GPT-NeoX-Japanese tokenizers under pull request #36121. Deploy an updated release that includes this commit across all inference and preprocessing hosts.

Workarounds

Cap the maximum input length accepted by any endpoint that feeds text into the affected tokenizers.
Place a validation layer in front of the tokenizer that rejects inputs matching known ReDoS trigger patterns.
Isolate tokenizer execution in a subprocess with a hard CPU-time limit using resource.setrlimit(RLIMIT_CPU, ...).

bash

# Upgrade to a patched version of transformers
pip install --upgrade 'transformers>4.48.1'

# Verify installed version contains the fix
python -c "import transformers; print(transformers.__version__)"

# Optional: enforce a request-level timeout at the application layer
export TOKENIZER_TIMEOUT_MS=500