Regular Expression Denial of Service in Hugging Face Transformers Library

CVE-2025-6921

What is CVE-2025-6921?

The Hugging Face Transformers library prior to version 4.53.0 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability within its AdamWeightDecay optimizer. This issue is triggered by the _do_use_weight_decay method, which improperly processes user-controlled regular expressions in specified lists. Attackers can exploit this vulnerability by inserting malicious regular expressions, resulting in catastrophic backtracking during the re.search operation. The exploitation can lead to excessive CPU utilization, causing system hangs and unresponsiveness during machine learning tasks, ultimately affecting service availability.

References