
We found results for “”
CVE-2025-5197
Good to know:

Date: August 6, 2025
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the Hugging Face Transformers library, specifically in the "convert_tf_weight_name_to_pt_weight_name()" function. This function, responsible for converting TensorFlow weight names to PyTorch format, uses a regex pattern "/[^/]*___([^/]*)/" that can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. The vulnerability affects versions up to 4.51.3 and is fixed in version 4.53.0. This issue can lead to service disruption, resource exhaustion, and potential API service vulnerabilities, impacting model conversion processes between TensorFlow and PyTorch formats.
Severity Score
Related Resources (6)
Severity Score
Weakness Type (CWE)
Inefficient Regular Expression Complexity
CWE-1333Top Fix

Upgrade Version
Upgrade to version transformers - 4.53.0;transformers - 4.53.0;https://github.com/huggingface/transformers.git - v4.53.0
CVSS v3.1
Base Score: |
|
---|---|
Attack Vector (AV): | NETWORK |
Attack Complexity (AC): | LOW |
Privileges Required (PR): | NONE |
User Interaction (UI): | NONE |
Scope (S): | UNCHANGED |
Confidentiality (C): | NONE |
Integrity (I): | NONE |
Availability (A): | LOW |