CVE-2025-3264

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_imports()` function within `dynamic_module_utils.py`. This vulnerability affects versions 4.49.0 and is fixed in version 4.51.0. The issue arises from a regular expression pattern `\s*try\s*:.*?except.*?:` used to filter out try/except blocks from Python code, which can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. This vulnerability can lead to remote code loading disruption, resource exhaustion in model serving, supply chain attack vectors, and development pipeline disruption.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/huggingface/transformers/commit/0720e206c6ba28887e4d60ef60a6a089f6c1cc76	Patch
https://huntr.com/bounties/3c6f7822-9992-476d-8cf0-b0b1623427df	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:huggingface:transformers:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-07-07 10:15

Updated : 2025-08-07 01:02

NVD link : CVE-2025-3264

Mitre link : CVE-2025-3264

CVE.ORG link : CVE-2025-3264

JSON object : View

Products Affected

huggingface

transformers

CWE

CWE-1333

Inefficient Regular Expression Complexity

{"id": "CVE-2025-3264", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2025-07-07T10:15:27.500", "references": [{"url": "https://github.com/huggingface/transformers/commit/0720e206c6ba28887e4d60ef60a6a089f6c1cc76", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://huntr.com/bounties/3c6f7822-9992-476d-8cf0-b0b1623427df", "tags": ["Exploit", "Third Party Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-1333"}]}], "descriptions": [{"lang": "en", "value": "A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_imports()` function within `dynamic_module_utils.py`. This vulnerability affects versions 4.49.0 and is fixed in version 4.51.0. The issue arises from a regular expression pattern `\\s*try\\s*:.*?except.*?:` used to filter out try/except blocks from Python code, which can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. This vulnerability can lead to remote code loading disruption, resource exhaustion in model serving, supply chain attack vectors, and development pipeline disruption."}, {"lang": "es", "value": "Se descubri\u00f3 una vulnerabilidad de denegaci\u00f3n de servicio por expresi\u00f3n regular (ReDoS) en la librer\u00eda Hugging Face Transformers, espec\u00edficamente en la funci\u00f3n `get_imports()` de `dynamic_module_utils.py`. Esta vulnerabilidad afecta a la versi\u00f3n 4.49.0 y se corrigi\u00f3 en la versi\u00f3n 4.51.0. El problema surge de un patr\u00f3n de expresi\u00f3n regular `\\s*try\\s*:.*?except.*?:` utilizado para filtrar bloques try/except del c\u00f3digo Python, que puede explotarse para causar un consumo excesivo de CPU mediante cadenas de entrada manipuladas debido a un retroceso catastr\u00f3fico. Esta vulnerabilidad puede provocar interrupciones en la carga remota de c\u00f3digo, agotamiento de recursos en la entrega de modelos, vectores de ataque a la cadena de suministro e interrupciones en el flujo de trabajo de desarrollo."}], "lastModified": "2025-08-07T01:02:30.700", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:huggingface:transformers:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C286893D-37B2-495A-A91F-F7CB2CFE872C", "versionEndExcluding": "4.51.0", "versionStartIncluding": "4.49.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}