CVE-2025-3264: Regular Expression Denial of Service (ReDoS) in huggingface/transformers
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the getimports() function within dynamicmoduleutils.py. This vulnerability affects versions 4.49.0 and is fixed in version 4.51.0. The issue arises from a regular expression pattern \stry\s:.?except.?: used to filter out try/except blocks from Python code, which can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. This vulnerability can lead to remote code loading disruption, resource exhaustion in model serving, supply chain attack vectors, and development pipeline disruption.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/transformersto a version that resolves this vulnerability.Fixed in 4.51.0 - Upgrade
Upgrade
huggingface/transformersto a version that resolves this vulnerability.Fixed in 4.51.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3264?
CVE-2025-3264 is classified as a Regular Expression Denial of Service (ReDoS) vulnerability.
How do I fix CVE-2025-3264?
To fix CVE-2025-3264, upgrade the Hugging Face Transformers library to version 4.51.0 or later.
Which versions of the Hugging Face Transformers library are affected by CVE-2025-3264?
CVE-2025-3264 affects Hugging Face Transformers version 4.49.0.
What component of Hugging Face Transformers is impacted by CVE-2025-3264?
CVE-2025-3264 impacts the `get_imports()` function within `dynamic_module_utils.py` in the Hugging Face Transformers library.
What type of attack does CVE-2025-3264 enable?
CVE-2025-3264 enables a Regular Expression Denial of Service (ReDoS) attack.