p PatchFirst

CVE-2025-3262

CVE-2025-3262 · Regular Expression Denial of Service (ReDoS) in huggingface/transformers

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vulnerability is due to inefficient regular expression complexity in the `SETTING_RE` variable within the `transformers/commands/chat.py` file. The regex contains repetition groups and non-optimized quantifiers, leading to exponential backtracking when processing 'almost matching' payloads. This can degrade application performance and potentially result in a denial-of-service (DoS) when handling specially crafted input strings. The issue is fixed in version 4.51.0.

CVSS 5.3 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • huggingface/transformers

    Versions
    • ≥ unspecified, < 4.51.0: Affected (custom)

    Update to 4.51.0

  • transformers PyPI

    Versions
    • 4.49.0
    • 4.50.0
    • 4.50.1
    • 4.50.2
    • 4.50.3
    Affected ranges
    • ECOSYSTEM: ≥ 4.49.0, < 4.51.0

    Update to 4.51.0

Original sources

Check your server →