CVE-2025-3262
📋 TL;DR
A Regular Expression Denial of Service (ReDoS) vulnerability in huggingface/transformers allows attackers to degrade application performance or cause denial-of-service by sending specially crafted input strings that trigger exponential backtracking in an inefficient regex. This affects users of transformers version 4.49.0 who process untrusted input through the chat functionality.
💻 Affected Systems
- huggingface/transformers
📦 What is this software?
Transformers by Huggingface
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to CPU exhaustion from regex processing, potentially affecting all users of the vulnerable application.
Likely Case
Degraded application performance, increased response times, and potential service disruption for users processing malicious input.
If Mitigated
Minimal impact with proper input validation, rate limiting, and updated regex patterns.
🎯 Exploit Status
Exploitation requires sending specially crafted strings to trigger regex backtracking; proof-of-concept details are publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.51.0
Vendor Advisory: https://github.com/huggingface/transformers/commit/0720e206c6ba28887e4d60ef60a6a089f6c1cc76
Restart Required: Yes
Instructions:
1. Update transformers package using pip: pip install transformers==4.51.0
2. Restart any services using the transformers library
3. Verify the update with pip show transformers
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation to reject or sanitize strings that could trigger regex backtracking.
Rate Limiting
allApply rate limiting to chat endpoints to prevent mass exploitation attempts.
🧯 If You Can't Patch
- Implement WAF rules to block patterns that trigger ReDoS attacks
- Monitor CPU usage and implement alerting for abnormal regex processing times
🔍 How to Verify
Check if Vulnerable:
Check if transformers version is 4.49.0 using pip show transformers or by examining package metadata.Check Version:
pip show transformers | grep VersionVerify Fix Applied:
Confirm transformers version is 4.51.0 or higher using pip show transformers.📡 Detection & Monitoring
Log Indicators:
- Unusually long processing times for chat requests
- High CPU usage spikes during input processing
- Multiple failed or timed-out chat requests
Network Indicators:
- Repeated requests with similar payload patterns to chat endpoints
- Abnormal request sizes or patterns
SIEM Query:
source="application_logs" AND (message="*chat*" AND duration>5s) OR (cpu_usage>90% AND process="python")