VYPR
← All advisories
Moderate severityNVD Advisory· Published Aug 6, 2025· Updated Aug 6, 2025

Regular Expression Denial of Service (ReDoS) in huggingface/transformers

CVE-2025-5197

Description

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the Hugging Face Transformers library, specifically in the convert_tf_weight_name_to_pt_weight_name() function. This function, responsible for converting TensorFlow weight names to PyTorch format, uses a regex pattern /[^/]*___([^/]*)/ that can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. The vulnerability affects versions up to 4.51.3 and is fixed in version 4.53.0. This issue can lead to service disruption, resource exhaustion, and potential API service vulnerabilities, impacting model conversion processes between TensorFlow and PyTorch formats.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A ReDoS vulnerability in Hugging Face Transformers' weight name conversion function allows crafted input to cause excessive CPU consumption via catastrophic backtracking.

Vulnerability

Overview

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the Hugging Face Transformers library, specifically in the convert_tf_weight_name_to_pt_weight_name() function. This function converts TensorFlow weight names to PyTorch format using the regex pattern /[^/]*___([^/]*)/. The regex is susceptible to catastrophic backtracking when processing crafted input strings containing many ___ separators, leading to excessive CPU consumption and potential service disruption [1][2].

Exploitation

Prerequisites

An attacker can exploit this vulnerability by providing a specially crafted TensorFlow weight name to the conversion function. The attack does not require authentication if the function is exposed via an API or service that accepts user-supplied weight names. The crafted input must contain a long string with multiple ___ patterns to trigger the backtracking behavior. The vulnerability affects versions up to 4.51.3 [2].

Impact

Successful exploitation results in a denial of service (DoS) condition, causing resource exhaustion and potentially impacting API services that rely on model conversion between TensorFlow and PyTorch formats. This can lead to service disruption and degraded performance for users of the affected library [2].

Mitigation

The vulnerability is fixed in Transformers version 4.53.0. The fix introduces a validation check that raises a ValueError if the TF variable name exceeds 2048 characters and contains ___, or if the count of ___ separators exceeds 10, preventing the regex from being evaluated on malicious input [3][4]. Users are advised to upgrade to version 4.53.0 or later.

References
  1. GitHub - huggingface/transformers: 🤗 Transformers: the model-definition framework for state-of-the-art machine learning models in text, vision, audio, and multimodal models, for both inference and training.
  2. NVD - CVE-2025-5197
  3. slight tweak to conditional · huggingface/transformers@944b560
  4. Stop TF weight rename reDOS (#38325) · huggingface/transformers@701caef

AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
transformersPyPI
< 4.53.04.53.0

Affected products

2

Patches

2
701caef704e3

Stop TF weight rename reDOS (#38325)

https://github.com/huggingface/transformersMattMay 26, 2025via ghsa
commit
1 file changed · +3 −0
  • src/transformers/modeling_tf_pytorch_utils.py+3 −0 modified
    @@ -78,6 +78,9 @@ def convert_tf_weight_name_to_pt_weight_name(
         tf_name = tf_name[len(name_scope) :]
         tf_name = tf_name.lstrip("/")
     tf_name = tf_name.replace(":0", "")  # device ids
+    if (len(tf_name) > 2048 and "___" in tf_name) or tf_name.count("___") > 10:
+        # ReDOS check
+        raise ValueError("TF variable name is too long or contains too many ___ separators: " + tf_name)
     tf_name = re.sub(
         r"/[^/]*___([^/]*)/", r"/\1/", tf_name
     )  # '$1___$2' is replaced by $2 (can be used to duplicate or remove layers in TF2.0 vs PyTorch)
944b56000be5

slight tweak to conditional

https://github.com/huggingface/transformersMattMay 23, 2025via ghsa
commit
1 file changed · +1 −0
  • src/transformers/modeling_tf_pytorch_utils.py+1 −0 modified
    @@ -79,6 +79,7 @@ def convert_tf_weight_name_to_pt_weight_name(
         tf_name = tf_name.lstrip("/")
     tf_name = tf_name.replace(":0", "")  # device ids
     if (len(tf_name) > 2048 and "___" in tf_name) or tf_name.count("___") > 10:
+        # ReDOS check
         raise ValueError("TF variable name is too long or contains too many ___ separators: " + tf_name)
     tf_name = re.sub(
         r"/[^/]*___([^/]*)/", r"/\1/", tf_name

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.