CVE-2025-2099: Huggingface Transformers ReDoS Vulnerability

CVE-2025-2099 Overview

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the preprocess_string() function within the transformers.testing_utils module of Huggingface Transformers version v4.48.3. The vulnerability stems from a poorly constructed regular expression containing nested quantifiers that processes code blocks in docstrings. When an attacker provides input containing a large number of newline characters, the regex engine experiences exponential backtracking, leading to excessive CPU consumption and potential application downtime.

Critical Impact

Attackers can exploit this vulnerability to cause Denial of Service conditions by sending specially crafted payloads that trigger exponential regex backtracking, resulting in high CPU usage and application unavailability.

Affected Products

• Huggingface Transformers v4.48.3
• Huggingface Transformers (versions prior to the security patch)

Discovery Timeline

• 2025-05-19 - CVE-2025-2099 published to NVD
• 2025-05-21 - Last updated in NVD database

Technical Details for CVE-2025-2099

Vulnerability Analysis

This vulnerability is classified under CWE-1333 (Inefficient Regular Expression Complexity). The core issue resides in the preprocess_string() function, which is responsible for parsing and processing docstrings containing code blocks. The function employs a regular expression pattern with nested quantifiers—a known antipattern that can lead to catastrophic backtracking scenarios.

When processing input strings, the regex engine attempts to match patterns in multiple ways. With nested quantifiers, the number of possible matching combinations grows exponentially with input length. This algorithmic complexity attack allows a remote attacker to craft payloads that force the regex engine into an extremely long processing loop, effectively consuming all available CPU resources.

The attack is particularly concerning because it can be triggered remotely without authentication, requires low complexity to execute, and directly impacts system availability.

Root Cause

The root cause is the use of a regular expression containing nested quantifiers within the preprocess_string() function. Nested quantifiers (such as (a+)+ or similar patterns) create ambiguous matching scenarios where the regex engine must explore an exponentially growing number of backtracking paths to determine if a match exists. When input contains sequences of characters that partially match the pattern—particularly strings with many newline characters in this case—the backtracking behavior becomes computationally expensive.

Attack Vector

The attack vector is network-based, allowing remote exploitation without requiring authentication or user interaction. An attacker can submit a malicious payload containing a carefully crafted string with numerous newline characters to any application endpoint that processes docstrings using the vulnerable preprocess_string() function. The attack does not compromise data confidentiality or integrity but directly impacts availability by exhausting CPU resources.

The exploitation mechanism works as follows: the attacker constructs a payload specifically designed to maximize regex backtracking. When the vulnerable function attempts to process this payload, the regex engine enters an extended computation loop, potentially lasting minutes or hours depending on payload size. During this time, the affected thread or process is unable to handle legitimate requests, resulting in denial of service.

Detection Methods for CVE-2025-2099

Indicators of Compromise

• Abnormally high CPU utilization on systems running Huggingface Transformers applications
• Application threads or processes becoming unresponsive during docstring processing operations
• Incoming requests containing unusually large numbers of newline characters
• System logs showing timeout errors or resource exhaustion warnings in transformers.testing_utils module

Detection Strategies

• Monitor CPU utilization patterns for sustained spikes coinciding with incoming requests to Transformers-based applications
• Implement application-level logging to track execution time of preprocess_string() function calls
• Deploy Web Application Firewall (WAF) rules to detect and block requests with abnormally high newline character counts
• Utilize behavioral analysis to identify request patterns that deviate from normal docstring processing workloads

Monitoring Recommendations

• Set up alerting thresholds for CPU usage anomalies on servers running Huggingface Transformers
• Enable detailed request logging to capture and analyze payloads that trigger extended processing times
• Monitor application response times and establish baselines to quickly identify degradation
• Implement rate limiting on endpoints that process user-supplied docstrings or code blocks

How to Mitigate CVE-2025-2099

Immediate Actions Required

• Update Huggingface Transformers to the latest patched version immediately
• Review application code to identify any direct usage of the preprocess_string() function with user-controlled input
• Implement input validation to limit the size and character composition of strings passed to docstring processing functions
• Consider implementing request timeouts to prevent long-running regex operations from consuming resources indefinitely

Patch Information

Huggingface has released a security patch to address this vulnerability. The fix is available in commit 8cb522b4190bd556ce51be04942720650b1a3e57. Organizations using Huggingface Transformers should update to the patched version as soon as possible. The patch can be reviewed at the Huggingface Transformers GitHub repository.

Additional details about the vulnerability discovery and disclosure are available through the Huntr bounty listing.

Workarounds

• Implement input sanitization to strip or limit excessive newline characters before passing strings to the vulnerable function
• Add execution timeouts around calls to preprocess_string() to prevent runaway CPU consumption
• Deploy rate limiting on API endpoints that process docstrings to reduce the impact of attempted exploitation
• Consider temporarily disabling or restricting access to features that rely on docstring preprocessing until the patch can be applied

# Update Huggingface Transformers to the latest version
pip install --upgrade transformers

# Verify the installed version
pip show transformers | grep Version