CVE-2025-1194

A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file `tokenization_gpt_neox_japanese.py` of the GPT-NeoX-Japanese model. The vulnerability occurs in the SubWordJapaneseTokenizer class, where regular expressions process specially crafted inputs. The issue stems from a regex exhibiting exponential complexity under certain conditions, leading to excessive backtracking. This can result in high CPU usage and potential application downtime, effectively creating a Denial of Service (DoS) scenario. The affected version is v4.48.1 (latest).

• CWE-1333

• https://github.com/huggingface/transformers/commit/92c5ca9dd70de3ade2af2eb835c96215cc50e815Patch
• https://huntr.com/bounties/86f58dcd-683f-4adc-a735-849f51e9abb2Exploit, Third Party Advisory
• https://huntr.com/bounties/86f58dcd-683f-4adc-a735-849f51e9abb2Exploit, Third Party Advisory

Published

Apr 29, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-11934Improper input validation in the TLS 1.3 CertificateVerify s…2.7
• CVE-2025-11935With TLS 1.3 pre-shared key (PSK) a malicious or faulty serv…7.5
• CVE-2025-11936Improper input validation in the TLS 1.3 KeyShareEntry parsi…5.3
• CVE-2025-11937Improper Neutralization of Input During Web Page Generation …6.9
• CVE-2025-11938A vulnerability was found in ChurchCRM up to 5.18.0. This vu…8.1
• CVE-2025-11939A vulnerability was determined in ChurchCRM up to 5.18.0. Th…7.2
• CVE-2025-11940A security vulnerability has been detected in LibreWolf up t…7.3
• CVE-2025-11941A vulnerability was detected in e107 CMS up to 2.3.3. This i…8.1
• CVE-2025-11942A flaw has been found in 70mai X200 up to 20251010. Affected…9.8
• CVE-2025-11943A vulnerability has been found in 70mai X200 up to 20251010.…9.8
• CVE-2025-11944A vulnerability was determined in givanz Vvveb up to 1.0.7.3…7.2
• CVE-2025-11945A vulnerability was identified in toeverything AFFiNE up to …3.5