Denial of Service Vulnerability in Hugging Face Transformers Library

CVE-2024-12720

What is CVE-2024-12720?

A Denial of Service vulnerability has been identified in the Hugging Face Transformers library, specifically within the tokenization_nougat_fast.py file. The issue arises from the post_process_single() function, where a regular expression operates on specially crafted inputs. Under certain conditions, the regex demonstrates exponential time complexity, leading to excessive backtracking. This can cause a significant increase in CPU usage, potentially resulting in application downtime and service disruptions.

References