CVE-2025-5197: Huggingface Transformers DoS Vulnerability

CVE-2025-5197 Overview

CVE-2025-5197 is a Regular Expression Denial of Service (ReDoS) vulnerability in the Hugging Face Transformers library. The flaw resides in the convert_tf_weight_name_to_pt_weight_name() function within src/transformers/modeling_tf_pytorch_utils.py, which converts TensorFlow weight names to PyTorch format. The function applies the regex pattern /[^/]*___([^/]*)/ to input strings, and crafted inputs trigger catastrophic backtracking that exhausts CPU resources. The vulnerability affects all versions up to and including 4.51.3 and is patched in version 4.53.0. It maps to CWE-1333: Inefficient Regular Expression Complexity.

Critical Impact
Attackers can trigger sustained CPU exhaustion in services that convert model weights, disrupting model conversion pipelines and any API endpoints that invoke the affected function.

Affected Products

Hugging Face Transformers versions up to and including 4.51.3
Applications and services embedding the modeling_tf_pytorch_utils module
ML pipelines performing TensorFlow-to-PyTorch weight conversion

Discovery Timeline

2025-08-06 - CVE-2025-5197 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5197

Vulnerability Analysis

The vulnerability originates in the weight-name conversion routine that bridges TensorFlow and PyTorch model formats. The routine relies on the regex /[^/]*___([^/]*)/ to rewrite variable names that use the ___ separator. Both capture groups use greedy quantifiers over overlapping character classes, which creates ambiguous match paths.

When the regex engine encounters an input containing many ___ sequences or a long path segment without a terminating slash, it explores an exponential number of backtracking permutations. The result is a single-input operation that consumes CPU for seconds or minutes. In an API context, one crafted request can saturate a worker process and starve legitimate requests.

The upstream fix in commit 944b56000be5e9b61af8301aa340838770ad8a0b rejects input before regex evaluation when the name exceeds 2048 characters and contains ___, or when the name contains more than 10 ___ separators.

Root Cause

The root cause is inefficient regular expression complexity [CWE-1333]. The pattern /[^/]*___([^/]*)/ permits multiple ways to partition the same input between the two [^/]* groups around the ___ literal, producing catastrophic backtracking on adversarial strings.

Attack Vector

Exploitation requires the attacker to supply a TensorFlow weight name to code paths that call convert_tf_weight_name_to_pt_weight_name(). This occurs in services that accept user-supplied models, model repositories, or checkpoint files and perform framework conversion. No authentication is required when the conversion endpoint is exposed publicly.

python

# Security patch in src/transformers/modeling_tf_pytorch_utils.py
     tf_name = tf_name.lstrip("/")
     tf_name = tf_name.replace(":0", "")  # device ids
     if (len(tf_name) > 2048 and "___" in tf_name) or tf_name.count("___") > 10:
+        # ReDOS check
         raise ValueError("TF variable name is too long or contains too many ___ separators: " + tf_name)
     tf_name = re.sub(
         r"/[^/]*___([^/]*)/", r"/\1/",  tf_name
# Source: https://github.com/huggingface/transformers/commit/944b56000be5e9b61af8301aa340838770ad8a0b

The patch adds an input length and separator-count guard that raises ValueError before the vulnerable re.sub call executes.

Detection Methods for CVE-2025-5197

Indicators of Compromise

Sustained single-core CPU saturation in Python worker processes running transformers
Long-running or hung requests to model-conversion endpoints without corresponding output
TensorFlow weight names in logs containing more than 10 ___ separators or exceeding 2048 characters
Elevated request latency correlated with calls into modeling_tf_pytorch_utils

Detection Strategies

Inspect application logs for ValueError exceptions referencing "TF variable name is too long or contains too many ___ separators" after upgrading, which indicate blocked ReDoS attempts
Instrument the convert_tf_weight_name_to_pt_weight_name() function with per-call duration metrics and alert on outliers
Use runtime application self-protection or WAF rules to flag inbound payloads whose string fields contain repeated ___ patterns

Monitoring Recommendations

Track CPU time per request for endpoints that accept model files or weight metadata
Monitor process-level thread and CPU counters for transformers-based workers and alert on sustained saturation
Audit dependency manifests to identify services still pinned to transformers versions at or below 4.51.3

How to Mitigate CVE-2025-5197

Immediate Actions Required

Upgrade Hugging Face Transformers to version 4.53.0 or later across all environments
Inventory internal services and Jupyter environments that import transformers.modeling_tf_pytorch_utils and prioritize their remediation
Restrict network exposure of any endpoint that performs on-demand TensorFlow-to-PyTorch conversion until patched

Patch Information

The fix is available in Hugging Face Transformers 4.53.0. Refer to the upstream patch commit and the Huntr bounty report for technical context. Reinstall dependent images and containers to ensure the patched module replaces cached bytecode.

Workarounds

Backport the input validation guard from the patch to reject weight names longer than 2048 characters that contain ___, or that contain more than 10 ___ separators
Enforce request timeouts and per-worker CPU limits for services invoking model conversion
Validate and sanitize weight names before passing them to transformers when accepting third-party models

bash

# Upgrade to the fixed release
pip install --upgrade "transformers>=4.53.0"

# Verify the installed version
python -c "import transformers; print(transformers.__version__)"