PT-2025-28150 · Hugging Face · Transformers
CVE-2025-3262
·
Publicado
2025-03-07
·
Atualizado
2026-07-07
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions:
huggingface/transformers version 4.49.0
Description:
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository. The vulnerability is due to inefficient regular expression complexity in the
SETTING RE variable within the transformers/commands/chat.py file. The regex contains repetition groups and non-optimized quantifiers, leading to exponential backtracking when processing 'almost matching' payloads. This can degrade application performance and potentially result in a denial-of-service (DoS) when handling specially crafted input strings.Recommendations:
For version 4.49.0, update to version 4.51.0 to resolve the issue. As a temporary workaround, consider restricting the use of the
SETTING RE variable within the transformers/commands/chat.py file to minimize the risk of exploitation. Avoid using the SETTING RE variable with untrusted input strings until the issue is resolved.Exploit
Correção
DoS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Transformers