Inefficient regular expression complexity in transformers - CVE-2025-2099

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU122993

Inefficient regular expression complexity in transformers - CVE-2025-2099

Published: February 17, 2026


Vulnerability identifier: #VU122993
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-2099
CWE-ID: CWE-1333
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing untrusted input with a regular expressions in the in the `preprocess_string()` function of the `transformers.testing_utils` module. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.


Affected software

transformers
DataStage on Cloud Pak for Data
Ansible Automation Platform

How to mitigate CVE-2025-2099

Cybersecurity Help is currently unaware of any official solution to address this vulnerability..

transformers - update to 4.50.0
DataStage on Cloud Pak for Data - update to 5.3.1
Ansible Automation Platform - update to 2.5

External References

Related Security Bulletins