PT-2025-39174 · Hugging Face · Transformers

Published 2025-06-18 · Updated 2025-10-10 · CVE-2025-6921

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions huggingface/transformers versions prior to 4.53.0

Description The software is susceptible to a Regular Expression Denial of Service (ReDoS) within the AdamWeightDecay optimizer. The issue stems from the do use weight decay method, which handles user-provided regular expressions found in the include in weight decay and exclude from weight decay lists. Specifically, malicious regular expressions can trigger catastrophic backtracking during the re.search call, resulting in high CPU usage and a denial of service. Attackers controlling these patterns can potentially disrupt machine learning tasks and cause services to become unresponsive.

Recommendations Update to version 4.53.0 or later.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2025-12550

CVE-2025-6921

GHSA-4W7R-H757-3R74

Affected Products

Transformers

References · 12

• 🔥 https://huntr.com/bounties/287d15a7-6e7c-45d2-8c05-11e305776f1f · Exploit
• https://github.com/huggingface/transformers/commit/47c34fba5c303576560cb29767efb452ff12b8be · Patch
• https://bdu.fstec.ru/vul/2025-12550 · Security Note
• https://osv.dev/vulnerability/CVE-2025-6921 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4w7r-h757-3r74 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6921 · Security Note
• https://github.com/huggingface/transformers · Note
• https://github.com/huggingface/transformers/commit/d37f7517972f67e3f2194c000ed0f87f064e5099 · Note
• https://t.me/cveNotify/138284 · Telegram Post
• https://t.me/CVEtracker/33168 · Telegram Post
• https://twitter.com/CVEnew/status/1970621808752959845 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1970651938917146850 · Twitter Post