https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 10:08:51 +0000 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0969 certfr-2025-avi-0969 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0969 https://cve.radiocsirt.org/vuln/euvd-2026-239951 EUVD-2026-239951 https://cve.radiocsirt.org/vuln/euvd-2026-239951 https://cve.radiocsirt.org/vuln/fkie_cve-2025-2099 <p>A vulnerability in the `preprocess_string()` function of the `transformers.testing_utils` module in huggingface/transformers version v4.48.3 allows for a Regular Expression Denial of Service (ReDoS) attack. The regular expression used to process code blocks in docstrings contains nested quantifiers, leading to exponential backtracking when processing input with a large number of newline characters. An attacker can exploit this by providing a specially crafted payload, causing high CPU usage and potential application downtime, effectively resulting in a Denial of Service (DoS) scenario.</p> <p>A vulnerability in the `preprocess_string()` function of the `transformers.testing_utils` module in huggingface/transformers version v4.48.3 allows for a Regular Expression Denial of Service (ReDoS) attack. The regular expression used to process code blocks in docstrings contains nested quantifiers, leading to exponential backtracking when processing input with a large number of newline characters. An attacker can exploit this by providing a specially crafted payload, causing high CPU usage and potential application downtime, effectively resulting in a Denial of Service (DoS) scenario.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-2099 https://cve.radiocsirt.org/vuln/ghsa-qq3j-4f4f-9583 <p><strong>Affected:</strong> PyPI: transformers</p> <p>A Regular Expression Denial of Service (ReDoS) exists in the `preprocess_string()` function of the `transformers.testing_utils` module. In versions **before 4.50.0**, the regex used to process code blocks in docstrings contains nested quantifiers that can trigger catastrophic backtracking when given inputs with many newline characters. An attacker who can supply such input to `preprocess_string()` (or code paths that call it) can force excessive CPU usage and degrade availability.</p> <p>**Fix:** released in **4.50.0**, which rewrites the regex to avoid the inefficient pattern. ([GitHub][1])</p> <p>* **Affected:** `&lt; 4.50.0` * **Patched:** `4.50.0`</p> <p><strong>Affected:</strong> PyPI: transformers</p> <p>A Regular Expression Denial of Service (ReDoS) exists in the `preprocess_string()` function of the `transformers.testing_utils` module. In versions **before 4.50.0**, the regex used to process code blocks in docstrings contains nested quantifiers that can trigger catastrophic backtracking when given inputs with many newline characters. An attacker who can supply such input to `preprocess_string()` (or code paths that call it) can force excessive CPU usage and degrade availability.</p> <p>**Fix:** released in **4.50.0**, which rewrites the regex to avoid the inefficient pattern. ([GitHub][1])</p> <p>* **Affected:** `&lt; 4.50.0` * **Patched:** `4.50.0`</p> https://cve.radiocsirt.org/vuln/ghsa-qq3j-4f4f-9583 https://cve.radiocsirt.org/vuln/pysec-2025-40 <p><strong>Affected:</strong> PyPI: transformers</p> <p>A vulnerability in the `preprocess_string()` function of the `transformers.testing_utils` module in huggingface/transformers version v4.48.3 allows for a Regular Expression Denial of Service (ReDoS) attack. The regular expression used to process code blocks in docstrings contains nested quantifiers, leading to exponential backtracking when processing input with a large number of newline characters. An attacker can exploit this by providing a specially crafted payload, causing high CPU usage and potential application downtime, effectively resulting in a Denial of Service (DoS) scenario.</p> <p><strong>Affected:</strong> PyPI: transformers</p> <p>A vulnerability in the `preprocess_string()` function of the `transformers.testing_utils` module in huggingface/transformers version v4.48.3 allows for a Regular Expression Denial of Service (ReDoS) attack. The regular expression used to process code blocks in docstrings contains nested quantifiers, leading to exponential backtracking when processing input with a large number of newline characters. An attacker can exploit this by providing a specially crafted payload, causing high CPU usage and potential application downtime, effectively resulting in a Denial of Service (DoS) scenario.</p> https://cve.radiocsirt.org/vuln/pysec-2025-40 https://cve.radiocsirt.org/vuln/rhsa-2025:12791 <p>transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers</p> <p>transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers</p> https://cve.radiocsirt.org/vuln/rhsa-2025:12791 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1707 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Ansible Automation Platform ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Ansible Automation Platform ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1707