PT-2025-28150 · Hugging Face · Transformers
CVE-2025-3262
·
Published
2025-03-07
·
Updated
2026-07-07
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions:
huggingface/transformers version 4.49.0
Description:
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository. The vulnerability is due to inefficient regular expression complexity in the
SETTING RE variable within the transformers/commands/chat.py file. The regex contains repetition groups and non-optimized quantifiers, leading to exponential backtracking when processing 'almost matching' payloads. This can degrade application performance and potentially result in a denial-of-service (DoS) when handling specially crafted input strings.Recommendations:
For version 4.49.0, update to version 4.51.0 to resolve the issue. As a temporary workaround, consider restricting the use of the
SETTING RE variable within the transformers/commands/chat.py file to minimize the risk of exploitation. Avoid using the SETTING RE variable with untrusted input strings until the issue is resolved.Exploit
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Transformers