PT-2025-28150 · Hugging Face · Transformers

CVE-2025-3262

·

Publicado

2025-03-07

·

Atualizado

2026-07-07

CVSS v2.0

7.8

Alta

VetorAV:N/AC:L/Au:N/C:N/I:N/A:C
Name of the Vulnerable Software and Affected Versions: huggingface/transformers version 4.49.0
Description: A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository. The vulnerability is due to inefficient regular expression complexity in the SETTING RE variable within the transformers/commands/chat.py file. The regex contains repetition groups and non-optimized quantifiers, leading to exponential backtracking when processing 'almost matching' payloads. This can degrade application performance and potentially result in a denial-of-service (DoS) when handling specially crafted input strings.
Recommendations: For version 4.49.0, update to version 4.51.0 to resolve the issue. As a temporary workaround, consider restricting the use of the SETTING RE variable within the transformers/commands/chat.py file to minimize the risk of exploitation. Avoid using the SETTING RE variable with untrusted input strings until the issue is resolved.

Exploit

Correção

DoS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾

Enumeração de Fraquezas

Identificadores relacionados

BDU:2026-03549
CVE-2025-3262
GHSA-489J-G2VX-39WF
PYSEC-2026-1979

Produtos afetados

Transformers