CVE-2025-3263: Regular Expression Denial of Service (ReDoS) in huggingface/transformers
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the getconfigurationfile() function within the transformers.configurationutils module. The affected version is 4.49.0, and the issue is resolved in version 4.51.0. The vulnerability arises from the use of a regular expression pattern config\.(.)\.json that can be exploited to cause excessive CPU consumption through crafted input strings, leading to catastrophic backtracking. This can result in model serving disruption, resource exhaustion, and increased latency in applications using the library.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/transformersto a version that resolves this vulnerability.Fixed in 4.51.0 - Upgrade
Upgrade
huggingface/transformersto a version that resolves this vulnerability.Fixed in 4.51.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3263?
CVE-2025-3263 is classified as a Regular Expression Denial of Service (ReDoS) vulnerability, which can severely impact application performance.
How do I fix CVE-2025-3263?
To fix CVE-2025-3263, update the Hugging Face Transformers library to the latest version that addresses this issue.
Which versions of Hugging Face Transformers are affected by CVE-2025-3263?
CVE-2025-3263 affects Hugging Face Transformers version 4.49.0.
What specific function is vulnerable in CVE-2025-3263?
The vulnerable function in CVE-2025-3263 is `get_configuration_file()` within the `transformers.configuration_utils` module.
Can CVE-2025-3263 lead to application downtime?
Yes, CVE-2025-3263 can potentially lead to application downtime due to Denial of Service caused by malicious regular expressions.