PT-2025-28151 · Hugging Face · Huggingface/Transformers

Published

2025-03-15

·

Updated

2025-08-07

·

CVE-2025-3263

CVSS v3.1

5.3

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Name of the Vulnerable Software and Affected Versions: Hugging Face Transformers version 4.49.0
Description: A Regular Expression Denial of Service (ReDoS) issue was discovered in the Hugging Face Transformers library, specifically in the get configuration file() function within the transformers.configuration utils module. The vulnerability arises from the use of a regular expression pattern config.(.*).json that can be exploited to cause excessive CPU consumption through crafted input strings, leading to catastrophic backtracking. This can result in model serving disruption, resource exhaustion, and increased latency in applications using the library.
Recommendations: For version 4.49.0, update to version 4.51.0 to resolve the issue. As a temporary workaround, consider disabling the get configuration file() function until a patch is available. Restrict access to the transformers.configuration utils module to minimize the risk of exploitation. Avoid using the regular expression pattern config.(.*).json in the affected function until the issue is resolved.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

BDU:2026-03548
CVE-2025-3263
GHSA-Q2WP-RJMX-X6X9

Affected Products

Huggingface/Transformers