CVE-2024-12720 — HIGH (CVSS 7.5) AI Security Vulnerability

Q: Is CVE-2024-12720 actively exploited?

No confirmed active exploitation of CVE-2024-12720 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2024-12720?

1. PATCH: Upgrade transformers to >= 4.48.0 (commit deac971c fixes the regex). 2. DETECT: Monitor for CPU spikes on tokenization workers; alert on >80% sustained CPU from inference processes. 3. WORKAROUND (if patching is blocked): Add input length caps (e.g., 10K chars) and character-class filtering upstream of the Nougat tokenizer. 4. ISOLATE: Run Nougat endpoints in dedicated containers with CPU limits (e.g., Kubernetes resource quotas) to prevent neighbor starvation. 5. INVENTORY: Audit all pip environments for transformers < 4.48.0 using `pip show transformers`.

Q: What systems are affected by CVE-2024-12720?

This vulnerability affects the following AI/ML architecture patterns: document processing pipelines, model serving, OCR and document understanding systems, multi-modal inference APIs.

Q: What is the CVSS score for CVE-2024-12720?

CVE-2024-12720 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.23%.

CISO Take

Any inference endpoint running HuggingFace Transformers < 4.48.0 with the Nougat tokenizer is network-exploitable by an unauthenticated attacker sending crafted input—no privileges needed. Patch to 4.48.0 immediately; if you can't, rate-limit or disable Nougat endpoints now. Low EPSS (0.14%) suggests no active exploitation yet, but this is trivial to weaponize once discovered.

Risk Assessment

CVSS 7.5 High with AV:N/AC:L/PR:N/UI:N means zero-barrier remote exploitation. Practical risk is elevated because Transformers is installed in virtually every ML environment—the blast radius is wide. EPSS 0.00137 indicates no current in-the-wild use, but the simplicity of the attack (craft a string, POST to endpoint) makes exploitation trivial once a PoC circulates. Containment window is narrow.

Affected Systems

Package	Ecosystem	Vulnerable Range	Patched
transformers	pip	—	No patch
160.2K OpenSSF 4.9 7.8K dependents Pushed 7d ago 39% patched ~101d to patch Full package profile →
transformers	pip	< 4.48.0	`4.48.0`
160.2K OpenSSF 4.9 7.8K dependents Pushed 7d ago 39% patched ~101d to patch Full package profile →

Severity & Risk

CVSS 3.1

7.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 45% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, CISA SSVC, EPSS, trickest/cve, and Nuclei templates.

Attack Surface

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I None

A High

Recommended Action

5 steps

PATCH

Upgrade transformers to >= 4.48.0 (commit deac971c fixes the regex).
DETECT

Monitor for CPU spikes on tokenization workers; alert on >80% sustained CPU from inference processes.
WORKAROUND (if patching is blocked): Add input length caps (e.g., 10K chars) and character-class filtering upstream of the Nougat tokenizer.
ISOLATE

Run Nougat endpoints in dedicated containers with CPU limits (e.g., Kubernetes resource quotas) to prevent neighbor starvation.
INVENTORY

Audit all pip environments for transformers < 4.48.0 using pip show transformers.

CISA SSVC Assessment

Decision Track*

Exploitation poc

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

Classification

DoS Framework Inference AML.T0029 - Denial of AI Service AML.T0034 - Cost Harvesting AML.T0049 - Exploit Public-Facing Application

Compliance Impact

This CVE is relevant to:

EU AI Act

Article 9 - Risk Management System

ISO 42001

6.1.2 - AI Risk Assessment 8.4 - AI System Operation

NIST AI RMF

MANAGE-2.2 - Treatment of Identified AI Risks MAP-5.1 - Likelihood and Magnitude of Each Identified Impact

OWASP LLM Top 10

LLM10:2025 - Unbounded Consumption

Frequently Asked Questions

What is CVE-2024-12720?

Any inference endpoint running HuggingFace Transformers < 4.48.0 with the Nougat tokenizer is network-exploitable by an unauthenticated attacker sending crafted input—no privileges needed. Patch to 4.48.0 immediately; if you can't, rate-limit or disable Nougat endpoints now. Low EPSS (0.14%) suggests no active exploitation yet, but this is trivial to weaponize once discovered.

Is CVE-2024-12720 actively exploited?

No confirmed active exploitation of CVE-2024-12720 has been reported, but organizations should still patch proactively.

How to fix CVE-2024-12720?

1. PATCH: Upgrade transformers to >= 4.48.0 (commit deac971c fixes the regex). 2. DETECT: Monitor for CPU spikes on tokenization workers; alert on >80% sustained CPU from inference processes. 3. WORKAROUND (if patching is blocked): Add input length caps (e.g., 10K chars) and character-class filtering upstream of the Nougat tokenizer. 4. ISOLATE: Run Nougat endpoints in dedicated containers with CPU limits (e.g., Kubernetes resource quotas) to prevent neighbor starvation. 5. INVENTORY: Audit all pip environments for transformers < 4.48.0 using `pip show transformers`.

What systems are affected by CVE-2024-12720?

This vulnerability affects the following AI/ML architecture patterns: document processing pipelines, model serving, OCR and document understanding systems, multi-modal inference APIs.

What is the CVSS score for CVE-2024-12720?

CVE-2024-12720 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.23%.

Technical Details

NVD Description

A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file tokenization_nougat_fast.py. The vulnerability occurs in the post_process_single() function, where a regular expression processes specially crafted input. The issue stems from the regex exhibiting exponential time complexity under certain conditions, leading to excessive backtracking. This can result in significantly high CPU usage and potential application downtime, effectively creating a Denial of Service (DoS) scenario. The affected version is v4.46.3 (latest).

Exploitation Scenario

An attacker targeting a document-intelligence API (common in legal, finance, healthcare AI stacks) sends a POST request with a specially crafted string containing nested repeating patterns that exploit the catastrophic backtracking in the Nougat tokenizer's post-processing regex. Each request pins one CPU core indefinitely. With 4-8 concurrent requests, a standard 4-vCPU inference pod is fully saturated. The service becomes unavailable within seconds, and Kubernetes liveness probes restart the pod—only for the attacker to repeat the cycle. No account, no token, no prior access required.