ReDoS vulnerability in huggingface/transformers regex
A Regular Expression Denial of Service (ReDoS) vulnerability was found in the documentation preprocessing regex of huggingface/transformers. The vulnerable pattern was patched with a simplified regex that avoids the catastrophic backtracking issue.
What happened
A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the regex pattern used for preprocessing documentation in huggingface/transformers. The vulnerable regex pattern was: r"(```(?:python|py)\s*\n\s*>>> )( (?:.*?\n)*? .*?```)". The vulnerability was fixed by simplifying the regex pattern to r"(```(?:python|py)\s*\n\s*>>> )(.*?```)".
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.