Catálogo de CVE

CVE-2025-2099

PYSEC-2025-40

[Catálogo de CVE]

A flaw was found in the preprocess_string() function of the transformers.testing_utils module in HuggingFace Transformers. This vulnerability allows a Regular Expression Denial of Service (ReDoS) via a specially crafted input string containing many newline characters that trigger excessive backtracking. transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Gravedad
High · CVSS 7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.61% · Oct 27, 2026

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
PyPIRelease not reportedtransformers4.49.0UnknownSource applicability is not established[PYSEC-2025-40]
PyPIRelease not reportedtransformers4.50.0UnknownSource applicability is not establishedGHSA-QQ3J-4F4F-9583
PyPIRelease not reportedtransformers8cb522b4190bd556ce51be04942720650b1a3e57UnknownSource applicability is not established[PYSEC-2025-40]
Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
PyPIRelease not reportedtransformers4.49.0UnknownSource applicability is not established[PYSEC-2025-40]
PyPIRelease not reportedtransformers4.50.0UnknownSource applicability is not establishedGHSA-QQ3J-4F4F-9583
PyPIRelease not reportedtransformers8cb522b4190bd556ce51be04942720650b1a3e57UnknownSource applicability is not established[PYSEC-2025-40]
Original provider fields
{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "transformers",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.50.0"
            }
          ]
        }
      ],
      "ecosystem": "PyPI",
      "fixed_version": "4.50.0",
      "provider_record_id": "GHSA-QQ3J-4F4F-9583",
      "applicability_unknown": true
    },
    {
      "name": "transformers",
      "ranges": [
        {
          "repo": "https://github.com/huggingface/transformers",
          "type": "GIT",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8cb522b4190bd556ce51be04942720650b1a3e57"
            }
          ]
        },
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.49.0"
            }
          ]
        }
      ],
      "ecosystem": "PyPI",
      "provider_url": "https://osv.dev/vulnerability/PYSEC-2025-40",
      "fixed_version": "4.49.0",
      "provider_source": "pypi",
      "provider_record_id": "PYSEC-2025-40",
      "provider_updated_at": "2026-06-10T17:02:48.111891265Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

La asociación de paquetes está en curso.

Observado:

Referencias

[CERT-Bund public advisories] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]