ConfirmedA court, a regulator or the organization itself has stated the core facts, or the record cites a court or regulator source.
ReDoS vulnerability in Hugging Face Transformers regex patterns fixed
Hugging Face Transformers contained regular expressions vulnerable to ReDoS attacks in tokenization modules for Nougat and Japanese language models. The vulnerability was fixed through code changes that avoid catastrophic backtracking.
AII-1001-917873 sources ↓
What happened
Exploitable regular expressions in the Nougat and GPTSan/GPTNeoXJapanese tokenization modules of Hugging Face Transformers displayed catastrophic backtracking behaviour.
The vulnerability was addressed by replacing the affected regex patterns with alternative versions that use possessive quantifiers in Python 3.11+ or modified patterns for earlier Python versions.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.
github.com
https://github.com/huggingface/transformers/commit/92c5ca9dd70de3ade2af2eb835c96215cc50e815