CVE-2025-3263 Overview
CVE-2025-3263 is a Regular Expression Denial of Service (ReDoS) vulnerability in the Hugging Face Transformers library. The flaw resides in the get_configuration_file() function within the transformers.configuration_utils module. Version 4.49.0 is affected, and the issue is resolved in version 4.51.0.
The vulnerable regular expression pattern config\.(.*)\.json is susceptible to catastrophic backtracking when processing crafted input strings. Attackers can trigger excessive CPU consumption, leading to model serving disruption, resource exhaustion, and increased latency in downstream applications that rely on the library.
Critical Impact
Remote unauthenticated attackers can exhaust CPU resources on servers running the Hugging Face Transformers library, degrading availability of machine learning inference services.
Affected Products
- Hugging Face Transformers version 4.49.0
- Applications embedding the transformers.configuration_utils module
- ML inference services and model-serving pipelines using vulnerable Transformers releases
Discovery Timeline
- 2025-07-07 - CVE-2025-3263 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-3263
Vulnerability Analysis
The vulnerability is classified under [CWE-1333] Inefficient Regular Expression Complexity. The get_configuration_file() function uses the regex pattern config\.(.*)\.json to match configuration filenames. The greedy .* quantifier between two literal segments creates ambiguity that a regex engine resolves through backtracking.
When an attacker supplies a specially crafted string containing repeated characters resembling the pattern, the regex engine explores an exponential number of match paths before failing. This behavior consumes CPU time disproportionate to input size, blocking the event loop or worker thread handling the request.
In model-serving environments, a single malicious configuration lookup can starve concurrent inference requests. The impact is limited to availability, but sustained requests can render an endpoint unresponsive without triggering standard authentication or authorization controls.
Root Cause
The root cause is the unbounded .* capture group inside the regular expression used to enumerate configuration files. Regular expression engines using backtracking-based matching cannot efficiently evaluate this pattern against adversarial inputs, resulting in catastrophic backtracking.
Attack Vector
Exploitation requires network-accessible functionality that passes attacker-controlled strings to get_configuration_file(). No authentication or user interaction is required. Any service that accepts model or configuration identifiers from untrusted sources and forwards them to the affected function is at risk.
# Patch reference: version bump enforcing the fixed release
# Source: https://github.com/huggingface/transformers/commit/0720e206c6ba28887e4d60ef60a6a089f6c1cc76
# Will error if the minimal version of Transformers is not installed. Remove at your own risks.
-check_min_version("4.51.0.dev0")
+check_min_version("4.51.0")
Source: Hugging Face Transformers commit 0720e20
Detection Methods for CVE-2025-3263
Indicators of Compromise
- Sustained high CPU utilization on Python worker processes hosting Transformers-based services
- Repeated inbound requests containing long or repetitive strings resembling config.<payload>.json
- Request latency spikes and worker timeouts correlated with configuration-loading code paths
Detection Strategies
- Inventory Python environments and identify installations of transformers==4.49.0 using package auditing tools such as pip list or SBOM scanners
- Instrument the get_configuration_file() call path with execution-time metrics to flag anomalous processing durations
- Deploy web application firewall rules that inspect request parameters for excessively long strings matching the vulnerable pattern
Monitoring Recommendations
- Track per-request CPU time and wall-clock duration for endpoints that load model configurations
- Alert on process-level CPU saturation combined with a low network throughput profile, a signature of algorithmic complexity attacks
- Correlate inference service errors with upstream request payload patterns to identify targeted ReDoS attempts
How to Mitigate CVE-2025-3263
Immediate Actions Required
- Upgrade Hugging Face Transformers to version 4.51.0 or later in all environments
- Audit downstream applications and container images for pinned dependencies on 4.49.0
- Apply request timeouts and CPU limits to worker processes that invoke Transformers configuration loaders
Patch Information
The fix is included in Transformers release v4.51.0. The upstream change is tracked in the Hugging Face Transformers commit 0720e20. Additional context on the vulnerability disclosure is available in the Huntr Bounty Report.
Workarounds
- Enforce input length limits on any user-supplied strings passed to configuration-loading functions
- Reject configuration filenames that do not match a strict allowlist prior to invoking Transformers APIs
- Run inference services behind rate limiting and per-request execution-time ceilings to contain ReDoS impact
# Upgrade to the patched release
pip install --upgrade "transformers>=4.51.0"
# Verify the installed version
python -c "import transformers; print(transformers.__version__)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
