CVE-2025-3263
Description
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the get_configuration_file() function within the transformers.configuration_utils module. The affected version is 4.49.0, and the issue is resolved in version 4.51.0. The vulnerability arises from the use of a regular expression pattern config\.(.*)\.json that can be exploited to cause excessive CPU consumption through crafted input strings, leading to catastrophic backtracking. This can result in model serving disruption, resource exhaustion, and increased latency in applications using the library.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
transformersPyPI | < 4.51.0 | 4.51.0 |
Affected products
2- huggingface/huggingface/transformersv5Range: unspecified
Patches
Vulnerability mechanics
References
5- github.com/huggingface/transformers/commit/0720e206c6ba28887e4d60ef60a6a089f6c1cc76nvdPatchWEB
- huntr.com/bounties/c7a69150-54f8-4e81-8094-791e7a2a0f29nvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-q2wp-rjmx-x6x9ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-3263ghsaADVISORY
- github.com/huggingface/transformers/commit/126abe3461762e5fc180e7e614391d1b4ab051caghsaWEB
News mentions
0No linked articles in our index yet.