CVE-2025-3264: Huggingface Transformers ReDoS Vulnerability

CVE-2025-3264 Overview

CVE-2025-3264 is a Regular Expression Denial of Service (ReDoS) vulnerability in the Hugging Face Transformers library. The flaw resides in the get_imports() function within dynamic_module_utils.py. A vulnerable regex pattern used to strip try/except blocks from Python code exhibits catastrophic backtracking when processing crafted inputs. Attackers can trigger excessive CPU consumption by supplying malicious module code that reaches this parser. The issue affects version 4.49.0 and is fixed in version 4.51.0. Exploitation disrupts remote code loading, exhausts resources in model-serving environments, and introduces supply chain risk in machine learning development pipelines. The weakness is tracked under CWE-1333 (Inefficient Regular Expression Complexity).

Critical Impact
Remote attackers can cause sustained CPU exhaustion in model-serving hosts and CI pipelines by delivering crafted Python module content parsed by get_imports().

Affected Products

Hugging Face Transformers version 4.49.0
Applications embedding transformers.dynamic_module_utils for dynamic model loading
Model-serving infrastructure that fetches remote Hugging Face modules

Discovery Timeline

2025-07-07 - CVE-2025-3264 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3264

Vulnerability Analysis

The Transformers library dynamically loads Python modules associated with community-published models. Before evaluating imports, get_imports() filters try/except blocks using the regex \s*try\s*:.*?except.*?:. The pattern combines lazy quantifiers with unanchored matching across arbitrary text, which produces catastrophic backtracking on adversarial inputs. Processing time grows non-linearly with input length, saturating a single CPU core for extended periods. Because dynamic module loading is invoked when a model is downloaded from the Hugging Face Hub, attacker-controlled repositories can weaponize this parsing step.

Root Cause

The regular expression relies on non-greedy .*? quantifiers surrounding two anchor tokens (try, except) without possessive matching or atomic grouping. When the regex engine encounters strings containing many partial matches of these keywords, it enumerates exponential backtracking paths. This design pattern is a canonical [CWE-1333] failure and does not require malformed input, only carefully structured Python-like content.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. A threat actor publishes a model or module on a public hub containing crafted Python content. When a downstream user or automated pipeline calls AutoModel.from_pretrained() with trust_remote_code=True, get_imports() parses the file and stalls on the ReDoS payload. In model-serving deployments, repeated requests amplify the impact and can degrade availability for co-tenant workloads.

The project maintainers addressed the issue in the v4.51.0 release. Example scripts were updated to require the patched minimum version:

python

# Will error if the minimal version of Transformers is not installed. Remove at your own risks.
-check_min_version("4.51.0.dev0")
+check_min_version("4.51.0")

Source: Hugging Face Transformers commit 0720e206

Detection Methods for CVE-2025-3264

Indicators of Compromise

Python worker processes sustaining 100% CPU while executing regex operations inside dynamic_module_utils.py
Unusually long response times or timeouts on endpoints that call from_pretrained() with trust_remote_code=True
Downloads from unfamiliar or newly created Hugging Face repositories immediately preceding CPU spikes

Detection Strategies

Instrument model-loading code paths to log execution time of get_imports() and alert when duration exceeds a defined threshold
Scan installed Python environments for transformers==4.49.0 using software composition analysis tools
Review outbound network telemetry for model downloads from untrusted namespaces and correlate with subsequent CPU anomalies

Monitoring Recommendations

Track per-process CPU utilization for Python interpreters running model-serving frameworks and set thresholds for sustained saturation
Enable audit logging on package installations to identify environments still pinned to Transformers 4.49.0
Monitor CI/CD job durations for statistical outliers when tests execute dynamic model loading

How to Mitigate CVE-2025-3264

Immediate Actions Required

Upgrade Hugging Face Transformers to version 4.51.0 or later in all production, staging, and development environments
Inventory pipelines that pass trust_remote_code=True and restrict this flag to vetted model sources
Apply CPU and wall-clock resource limits to processes that download or execute remote model code

Patch Information

The vulnerability is remediated in Transformers v4.51.0. See the upstream fix in commit 0720e206 and the bounty disclosure at Huntr.

Workarounds

Disable trust_remote_code and load only models that do not require dynamic module execution
Mirror approved models to an internal registry and block direct downloads from the public Hugging Face Hub
Wrap model-loading invocations with per-call CPU time limits using resource.setrlimit(RLIMIT_CPU, ...) to bound ReDoS impact

bash

# Upgrade to the patched release
pip install --upgrade "transformers>=4.51.0"

# Verify the installed version
python -c "import transformers; print(transformers.__version__)"