CVE-2025-2099

A vulnerability in the `preprocess_string()` function of the `transformers.testing_utils` module in huggingface/transformers version v4.48.3 allows for a Regular Expression Denial of Service (ReDoS) attack. The regular expression used to process code blocks in docstrings contains nested quantifiers, leading to exponential backtracking when processing input with a large number of newline characters. An attacker can exploit this by providing a specially crafted payload, causing high CPU usage and potential application downtime, effectively resulting in a Denial of Service (DoS) scenario.

• CWE-1333

• https://github.com/huggingface/transformers/commit/8cb522b4190bd556ce51be04942720650b1a3e57Patch
• https://huntr.com/bounties/97b780f3-ffca-424f-ad5d-0e1c57a5bde4Exploit, Third Party Advisory

Published

May 19, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-20984Incorrect default permission in Samsung Cloud for Galaxy Wat…6.2
• CVE-2025-20985Improper privilege management in ThemeManager prior to SMR J…3.3
• CVE-2025-20986Improper access control in ScreenCapture for Galaxy Watch pr…5.5
• CVE-2025-20987Improper access control in fingerprint trustlet prior to SMR…6.7
• CVE-2025-20988Out-of-bounds read in fingerprint trustlet prior to SMR May-…7.1
• CVE-2025-20989Improper logging in fingerprint trustlet prior to SMR May-20…5.2
• CVE-2025-20990Improper access control in accessing system device node prio…3.3
• CVE-2025-20991Improper export of Android application components in Bluetoo…5.1
• CVE-2025-20992Out-of-bound read in libsecimaging.camera.samsung.so prior t…7.7
• CVE-2025-20993Out-of-bounds write in libsecimaging.camera.samsung.so prior…6.8
• CVE-2025-20994Improper handling of insufficient permission in SyncClientPr…7.1
• CVE-2025-20995Improper handling of insufficient permission in ClientProvid…7.1