Regular Expression Denial of Service in Hugging Face Transformers Library

CVE-2025-3263

What is CVE-2025-3263?

A ReDoS vulnerability has been identified in the Hugging Face Transformers library, specifically within the get_configuration_file() function in the transformers.configuration_utils module. This vulnerability is triggered by the inefficient regex pattern config\.(.*)\.json, which can lead to increased CPU consumption when attackers provide specially crafted input strings. Such exploitation can result in severe performance degradation, including resource exhaustion and heightened latency for applications utilizing the library. The issue has been addressed in version 4.51.0, highlighting the importance of updating to mitigate potential disruptions in model serving.

References