CVE-2025-3262

Description

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vulnerability is due to inefficient regular expression complexity in the `SETTING_RE` variable within the `transformers/commands/chat.py` file. The regex contains repetition groups and non-optimized quantifiers, leading to exponential backtracking when processing 'almost matching' payloads. This can degrade application performance and potentially result in a denial-of-service (DoS) when handling specially crafted input strings. The issue is fixed in version 4.51.0.

Reserved 2025-04-04 | Published 2025-07-07 | Updated 2025-07-07 | Assigner @huntr_ai

Problem types

CWE-1333 Inefficient Regular Expression Complexity

Product status

Any version before 4.51.0
affected

References

huntr.com/bounties/ecf5ccc4-39e7-4fb3-b547-14a41d31a184

github.com/...ommit/0720e206c6ba28887e4d60ef60a6a089f6c1cc76

cve.org (CVE-2025-3262)

nvd.nist.gov (CVE-2025-3262)

Download JSON