Regular Expression Denial of Service Vulnerability in Hugging Face Transformers Library

CVE-2025-3264

What is CVE-2025-3264?

A Regular Expression Denial of Service (ReDoS) vulnerability in the Hugging Face Transformers library, particularly in the get_imports() function found in dynamic_module_utils.py, has been identified. It affects version 4.49.0 and allows attackers to exploit a flawed regular expression pattern used to filter Python try/except code blocks. The vulnerability can lead to excessive CPU consumption due to catastrophic backtracking, ultimately disrupting remote code loading processes, exhausting resources in model serving, and opening potential supply chain attack vectors.

References