{"id":"CVE-2025-1194","aliases":["GHSA-fpwr-67px-3qhx","PYSEC-2026-1984"],"title":"Transformers Regular Expression Denial of Service (ReDoS) vulnerability","summary":"Transformers Regular Expression Denial of Service (ReDoS) vulnerability","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","vendor":"transformers","product":"transformers","ecosystem":"pip","affected":["transformers < 4.50.0"],"patched":["transformers 4.50.0"],"published":"2025-04-29","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-fpwr-67px-3qhx","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1194"},{"url":"https://github.com/huggingface/transformers/commit/92c5ca9dd70de3ade2af2eb835c96215cc50e815"},{"url":"https://github.com/huggingface/transformers"},{"url":"https://huntr.com/bounties/86f58dcd-683f-4adc-a735-849f51e9abb2"}],"tags":["osv","pip"],"epss":0.00464,"epssPercentile":0.39417,"ingestedAt":"2026-07-08T18:25:49.075Z","slug":"CVE-2025-1194","body":"## Overview\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file `tokenization_gpt_neox_japanese.py` of the GPT-NeoX-Japanese model. The vulnerability occurs in the SubWordJapaneseTokenizer class, where regular expressions process specially crafted inputs. The issue stems from a regex exhibiting exponential complexity under certain conditions, leading to excessive backtracking. This can result in high CPU usage and potential application downtime, effectively creating a Denial of Service (DoS) scenario. The affected version is v4.48.1 (latest).\n\n## Affected packages\n\n- `transformers < 4.50.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `transformers 4.50.0`","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}