CVE-2024-12720: Transformers ReDoS — HIGH

Q: Is CVE-2024-12720 actively exploited?

No confirmed active exploitation of CVE-2024-12720 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2024-12720?

1. PATCH: Upgrade transformers to >= 4.48.0 (commit deac971c fixes the regex). 2. DETECT: Monitor for CPU spikes on tokenization workers; alert on >80% sustained CPU from inference processes. 3. WORKAROUND (if patching is blocked): Add input length caps (e.g., 10K chars) and character-class filtering upstream of the Nougat tokenizer. 4. ISOLATE: Run Nougat endpoints in dedicated containers with CPU limits (e.g., Kubernetes resource quotas) to prevent neighbor starvation. 5. INVENTORY: Audit all pip environments for transformers < 4.48.0 using `pip show transformers`.

Q: What systems are affected by CVE-2024-12720?

This vulnerability affects the following AI/ML architecture patterns: document processing pipelines, model serving, OCR and document understanding systems, multi-modal inference APIs.

Q: What is the CVSS score for CVE-2024-12720?

CVE-2024-12720 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.69%.

CISO Take

Any inference endpoint running HuggingFace Transformers < 4.48.0 with the Nougat tokenizer is network-exploitable by an unauthenticated attacker sending crafted input—no privileges needed. Patch to 4.48.0 immediately; if you can't, rate-limit or disable Nougat endpoints now. Low EPSS (0.14%) suggests no active exploitation yet, but this is trivial to weaponize once discovered.

What is the risk?

CVSS 7.5 High with AV:N/AC:L/PR:N/UI:N means zero-barrier remote exploitation. Practical risk is elevated because Transformers is installed in virtually every ML environment—the blast radius is wide. EPSS 0.00137 indicates no current in-the-wild use, but the simplicity of the attack (craft a string, POST to endpoint) makes exploitation trivial once a PoC circulates. Containment window is narrow.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Transformers	pip	—	No patch
161.8K OpenSSF 6.4 8.3K dependents Pushed 4d ago 40% patched ~92d to patch Full package profile →
Transformers	pip	< 4.48.0	`4.48.0`
161.8K OpenSSF 6.4 8.3K dependents Pushed 4d ago 40% patched ~92d to patch Full package profile →

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 48% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I None

A High

What should I do?

5 steps

PATCH

Upgrade transformers to >= 4.48.0 (commit deac971c fixes the regex).
DETECT

Monitor for CPU spikes on tokenization workers; alert on >80% sustained CPU from inference processes.
WORKAROUND (if patching is blocked): Add input length caps (e.g., 10K chars) and character-class filtering upstream of the Nougat tokenizer.
ISOLATE

Run Nougat endpoints in dedicated containers with CPU limits (e.g., Kubernetes resource quotas) to prevent neighbor starvation.
INVENTORY

Audit all pip environments for transformers < 4.48.0 using pip show transformers.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS Framework Inference AML.T0029 - Denial of AI Service AML.T0034 - Cost Harvesting AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk Management System

ISO 42001

6.1.2 - AI Risk Assessment 8.4 - AI System Operation

NIST AI RMF

MANAGE-2.2 - Treatment of Identified AI Risks MAP-5.1 - Likelihood and Magnitude of Each Identified Impact

OWASP LLM Top 10

LLM10:2025 - Unbounded Consumption

Frequently Asked Questions

What is CVE-2024-12720?

Any inference endpoint running HuggingFace Transformers < 4.48.0 with the Nougat tokenizer is network-exploitable by an unauthenticated attacker sending crafted input—no privileges needed. Patch to 4.48.0 immediately; if you can't, rate-limit or disable Nougat endpoints now. Low EPSS (0.14%) suggests no active exploitation yet, but this is trivial to weaponize once discovered.

Is CVE-2024-12720 actively exploited?

No confirmed active exploitation of CVE-2024-12720 has been reported, but organizations should still patch proactively.

How to fix CVE-2024-12720?

1. PATCH: Upgrade transformers to >= 4.48.0 (commit deac971c fixes the regex). 2. DETECT: Monitor for CPU spikes on tokenization workers; alert on >80% sustained CPU from inference processes. 3. WORKAROUND (if patching is blocked): Add input length caps (e.g., 10K chars) and character-class filtering upstream of the Nougat tokenizer. 4. ISOLATE: Run Nougat endpoints in dedicated containers with CPU limits (e.g., Kubernetes resource quotas) to prevent neighbor starvation. 5. INVENTORY: Audit all pip environments for transformers < 4.48.0 using `pip show transformers`.

What systems are affected by CVE-2024-12720?

This vulnerability affects the following AI/ML architecture patterns: document processing pipelines, model serving, OCR and document understanding systems, multi-modal inference APIs.

What is the CVSS score for CVE-2024-12720?

CVE-2024-12720 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.69%.

What is the AI security impact?

Affected AI Architectures

document processing pipelinesmodel servingOCR and document understanding systemsmulti-modal inference APIs

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0034 Cost Harvesting

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: 6.1.2, 8.4

NIST AI RMF: MANAGE-2.2, MAP-5.1

OWASP LLM Top 10: LLM10:2025

What are the technical details?

Original Advisory

A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file tokenization_nougat_fast.py. The vulnerability occurs in the post_process_single() function, where a regular expression processes specially crafted input. The issue stems from the regex exhibiting exponential time complexity under certain conditions, leading to excessive backtracking. This can result in significantly high CPU usage and potential application downtime, effectively creating a Denial of Service (DoS) scenario. The affected version is v4.46.3 (latest).

Exploitation Scenario

An attacker targeting a document-intelligence API (common in legal, finance, healthcare AI stacks) sends a POST request with a specially crafted string containing nested repeating patterns that exploit the catastrophic backtracking in the Nougat tokenizer's post-processing regex. Each request pins one CPU core indefinitely. With 4-8 concurrent requests, a standard 4-vCPU inference pod is fully saturated. The service becomes unavailable within seconds, and Kubernetes liveness probes restart the pod—only for the attacker to repeat the cycle. No account, no token, no prior access required.

Weaknesses (CWE)

CWE-1333 Inefficient Regular Expression Complexity Primary CWE-1333 Inefficient Regular Expression Complexity

CWE-1333 — Inefficient Regular Expression Complexity: The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

[Architecture and Design] Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
[System Configuration] Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.

Source: MITRE CWE corpus.