CVE-2025-3262
Description
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vulnerability is due to inefficient regular expression complexity in the `SETTING_RE` variable within the `transformers/commands/chat.py` file. The regex contains repetition groups and non-optimized quantifiers, leading to exponential backtracking when processing 'almost matching' payloads. This can degrade application performance and potentially result in a denial-of-service (DoS) when handling specially crafted input strings. The issue is fixed in version 4.51.0.
How to fix
- huggingface transformers4.51.0 or later
- transformers4.51.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| huggingface transformers | v < 4.51.0 | 4.51.0 |
| transformersPyPI | 4.49.0 ≤ v < 4.51.0 | 4.51.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.