Regular Expression Denial of Service (ReDoS) in huggingface/transformers (huggingface huggingface/transformers)
En bref
- Source
- NVD
- EPSS
- EPSS 0.50 % · centile 43 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- @huntr_ai
- Statut NVD
- Analyzed
Description
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_configuration_file()` function within the `transformers.configuration_utils` module. The affected version is 4.49.0, and the issue is resolved in version 4.51.0. The vulnerability arises from the use of a regular expression pattern `config\.(.*)\.json` that can be exploited to cause excessive CPU consumption through crafted input strings, leading to catastrophic backtracking. This can result in model serving disruption, resource exhaustion, and increased latency in applications using the library.
Faiblesses (CWE)
- CWE-1333 — Complexité inefficace d'expression régulière (ReDoS)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | MEDIUM 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | @huntr_ai |
| CVSS 3.0 | MEDIUM 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | NVD · security@huntr.dev (Secondary) |
Avis
- GHSA-q2wp-rjmx-x6x9 — Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking
- PYSEC-2026-1987 — Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking
Références européennes
- ENISA EUVD · EUVD-2025-20215
- GCVE · GCVE-0-2025-3263
Avis du CERT-FR
- CERTFR-2026-AVI-0556 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0969 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:huggingface:transformers:*:*:*:*:*:*:*:*≥ 4.49.0 < 4.51.0
Produits affectés
| Produit | Versions |
|---|---|
| huggingface · huggingface/transformers | affected unspecified < 4.51.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |