Inefficient regular expression complexity in transformers - CVE-2025-1194

Vulnerability identifier: #VU108910

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-1194

CWE-ID: CWE-1333

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing untrusted input with a regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

transformers
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Maximo Application Suite Ai Service
watsonx Code Assistant On Prem
Maximo Application Suite - Monitor Component
App Connect Enterprise Certified Container

Cybersecurity Help is currently unaware of any official solution to address this vulnerability..

transformers - update to 4.48.2
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.2.1
Maximo Application Suite Ai Service - update to 9.1.3
watsonx Code Assistant On Prem - update to 5.1.3
Maximo Application Suite - Monitor Component - update to 9.1.0
App Connect Enterprise Certified Container - addressed in versions 12.0.11, 12.11.0

• https://github.com/huggingface/transformers/commit/92c5ca9dd70de3ade2af2eb835c96215cc50e815
• https://huntr.com/bounties/86f58dcd-683f-4adc-a735-849f51e9abb2

• Inefficient regular expression complexity in huggingface/transformers
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• IBM Maximo Application Suite - Monitor Component update for huggingface/transformers library
• IBM watsonx Code Assistant On Prem update for huggingface/transformers library
• IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data update for transformers
• IBM Maximo AI Service update for huggingface/transformers