CVE-2025-1194

Executive Summary

CVE-2025-1194 is a Regular Expression Denial of Service (ReDoS) vulnerability discovered in the Hugging Face Transformers library, specifically within the tokenization_gpt_neox_japanese.py file of the GPT-NeoX-Japanese model. The flaw resides in the SubWordJapaneseTokenizer class, where a regular expression exhibits exponential complexity when processing specially crafted inputs. This leads to excessive backtracking, causing high CPU consumption and potential application downtime, effectively enabling a Denial of Service (DoS) attack. The vulnerability affects version v4.48.1, which is the latest at the time of disclosure. No patch is currently available, and no public proof-of-concept (PoC) or exploit code has been released. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains for environments using this tokenizer.

Supply Chain & Package Security

This vulnerability affects the PyPI package transformers. Organizations using this library in production, especially for Japanese language models, should monitor for updates and apply mitigations immediately. The lack of a patch increases supply chain risk, as malicious actors could craft inputs to cause service disruption.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The impact is confined to the vulnerable component.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: Low (A:L) – High CPU usage and potential downtime.

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation (no authentication, low complexity) and the potential for service disruption make it a concern for high-availability environments.

Deep Dive & Mechanics

The vulnerability is a classic ReDoS (Regular Expression Denial of Service) flaw. In the SubWordJapaneseTokenizer class, a regular expression is used to tokenize Japanese text. The regex contains nested quantifiers or overlapping patterns that cause exponential backtracking when processing specially crafted input strings. For example, a pattern like (a+)+b can cause catastrophic backtracking if the input contains many 'a's followed by a character that is not 'b'. The tokenizer's regex likely has similar characteristics, allowing an attacker to send a small, malicious string that forces the regex engine to explore an exponential number of paths, consuming 100% CPU and blocking the application thread.

The vulnerable code is in tokenization_gpt_neox_japanese.py. The exact regex pattern is not publicly disclosed, but it is known to be in the SubWordJapaneseTokenizer class. The attack vector is network-based, as the tokenizer is typically used in inference pipelines that accept user input.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern. The vulnerable regex likely looks like:

# Vulnerable pattern (hypothetical)
pattern = r'([a-zA-Z]+)+[0-9]'

This pattern, when applied to a string like "aaaa...b", causes exponential backtracking. A patched version would use atomic grouping or possessive quantifiers to prevent backtracking:

# Patched pattern (hypothetical)
pattern = r'([a-zA-Z]++)+[0-9]'  # Possessive quantifier

Or use a non-backtracking approach:

# Alternative patched pattern
pattern = r'[a-zA-Z]+[0-9]'

Until a patch is released, users must rely on workarounds.

Exploitation & Lab Setup

Red Team (Offensive)

Objective: Trigger a Denial of Service by sending a crafted input to the GPT-NeoX-Japanese tokenizer.

Lab Setup:

1. Install the vulnerable version: pip install transformers==4.48.1
2. Use the following Python script to test:

import transformers
from transformers import GPTNeoXForCausalLM, GPTNeoXTokenizerFast

# Load the tokenizer (Japanese model)
tokenizer = GPTNeoXTokenizerFast.from_pretrained("tokenizer_name")

# Craft a malicious input (example pattern)
malicious_input = "a" * 100 + "!"  # Adjust based on actual regex

# Trigger the vulnerability
try:
    tokens = tokenizer(malicious_input)
except Exception as e:
    print(f"Error: {e}")

Note: The exact malicious string depends on the undisclosed regex. Use fuzzing to identify the pattern.

Exploit Code: No public exploit exists. The above script is a conceptual test.

Blue Team (Defensive)

Detection: Monitor CPU usage spikes and application hangs. Use the detection rules below.

Mitigation:

• Implement input validation to limit string length and character types.
• Use a Web Application Firewall (WAF) to block suspicious patterns.
• Apply rate limiting to tokenizer endpoints.
• Consider using a timeout wrapper for the tokenizer function.

Indicators of Compromise (IOCs)

• Network: Unusual high CPU usage on servers running Hugging Face Transformers.
• Logs: Application logs showing repeated tokenization failures or timeouts.
• Process: High CPU consumption by Python processes using the transformers library.
• File: No specific file IOCs; the attack is input-based.

Detection Engineering

YARA Rule

rule CVE_2025_1194_ReDoS_Transformers {
    meta:
        description = "Detects potential ReDoS attack patterns targeting Hugging Face Transformers GPT-NeoX-Japanese tokenizer"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-1194"
    strings:
        $re_pattern = /([a-zA-Z]+)+[0-9]/  // Hypothetical pattern; adjust based on actual regex
        $long_string = /[a-zA-Z]{50,}/  // Long alphabetic strings
    condition:
        $re_pattern and $long_string
}

Sigma Rule

title: CVE-2025-1194 ReDoS Attempt Against Hugging Face Transformers
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential ReDoS attack via crafted input to GPT-NeoX-Japanese tokenizer
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: python
detection:
    selection:
        EventID: 100  # Example event ID for tokenizer errors
        Message|contains: "tokenization_gpt_neox_japanese"
    condition: selection
falsepositives:
    - Legitimate long Japanese text
level: medium

Suricata Rule

alert tcp any any -> any 80 (msg:"CVE-2025-1194 ReDoS Attempt Against Hugging Face Transformers"; flow:to_server,established; content:"tokenization_gpt_neox_japanese"; nocase; pcre:"/([a-zA-Z]+)+[0-9]/"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Limit the length and character set of inputs to the tokenizer. For example, reject strings longer than 1000 characters or containing only alphabetic characters.
2. Timeout Wrapper: Wrap the tokenizer call with a timeout to prevent indefinite hangs:

   import signal
   class TimeoutError(Exception):
       pass
   def handler(signum, frame):
       raise TimeoutError("Tokenizer timeout")
   signal.signal(signal.SIGALRM, handler)
   signal.alarm(5)  # 5 seconds timeout
   try:
       tokens = tokenizer(input_text)
   except TimeoutError:
       print("Timeout - possible ReDoS attack")
   finally:
       signal.alarm(0)
   

3. Rate Limiting: Implement rate limiting on endpoints that use the tokenizer.
4. WAF Rules: Deploy WAF rules to block patterns matching the vulnerable regex.

Long-Term Fix:

• Monitor the Hugging Face repository for a patch. Once available, update to the patched version.
• Consider switching to an alternative tokenizer if the Japanese model is not critical.

Valters IT Signature: This report is provided by Valters IT for educational and defensive purposes. Unauthorized exploitation is illegal.