CVE-2024-12720

Summary

CVE-2024-12720 is a new Denial of Service (DoS) vulnerability affecting the huggingface/transformers library, specifically the file tokenization_nougat_fast.py in version v4.46.3 (latest). The issue lies in the post_process_single() function, where a regular expression processes specially crafted input. The affected regex exhibits exponential time complexity under certain conditions, leading to excessive backtracking and causing significant CPU usage. This can result in potential application downtime, making it an effective DoS scenario. The vulnerability type is referred to as Regular Expression Denial of Service (ReDoS).

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.