CVE-2025-3262: Regular Expression Denial of Service (ReDoS) in huggingface/transformers
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vulnerability is due to inefficient regular expression complexity in the SETTINGRE variable within the transformers/commands/chat.py file. The regex contains repetition groups and non-optimized quantifiers, leading to exponential backtracking when processing 'almost matching' payloads. This can degrade application performance and potentially result in a denial-of-service (DoS) when handling specially crafted input strings. The issue is fixed in version 4.51.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/transformersto a version that resolves this vulnerability.Fixed in 4.51.0 - Upgrade
Upgrade
huggingface/transformersto a version that resolves this vulnerability.Fixed in 4.51.0 - Configuration
Update transformers so that the `SETTING_RE` variable in `transformers/commands/chat.py` uses the regex implementation from version 4.51.0 to prevent exponential backtracking on almost-matching payloads.
transformers/commands/chat.py SETTING_RE = Use the optimized regex as in transformers version 4.51.0 (fixes inefficient regular expression complexity causing ReDoS)
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3262?
The severity of CVE-2025-3262 is classified as Moderate due to its potential to cause a denial of service.
How do I fix CVE-2025-3262?
To fix CVE-2025-3262, upgrade the Hugging Face Transformers library to a version higher than 4.51.0.
What is the nature of the vulnerability in CVE-2025-3262?
CVE-2025-3262 is a Regular Expression Denial of Service (ReDoS) vulnerability caused by inefficient regular expression complexity.
Which versions of the software are affected by CVE-2025-3262?
CVE-2025-3262 affects Hugging Face Transformers version 4.49.0 and prior to 4.51.0.
Where can I find more information about CVE-2025-3262?
More information about CVE-2025-3262 can be found in the commit history of the Hugging Face Transformers repository.