{"cve":"CVE-2025-3263","nvd":{"published":"2025-07-07T10:15:27.350","modified":"2026-06-17T09:19:32.880","status":"Analyzed","description":"A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_configuration_file()` function within the `transformers.configuration_utils` module. The affected version is 4.49.0, and the issue is resolved in version 4.51.0. The vulnerability arises from the use of a regular expression pattern `config\\.(.*)\\.json` that can be exploited to cause excessive CPU consumption through crafted input strings, leading to catastrophic backtracking. This can result in model serving disruption, resource exhaustion, and increased latency in applications using the library.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3},"cwes":["CWE-1333"],"references":["https://github.com/huggingface/transformers/commit/0720e206c6ba28887e4d60ef60a6a089f6c1cc76","https://huntr.com/bounties/c7a69150-54f8-4e81-8094-791e7a2a0f29"],"products":["huggingface:transformers"],"source":"nvd","synced_at":"2026-10-19T22:04:28.436527499+00:00"},"epss":{"cve":"CVE-2025-3263","score":0.00496,"percentile":0.42559,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-q2wp-rjmx-x6x9","url":"https://osv.dev/vulnerability/GHSA-q2wp-rjmx-x6x9","summary":"Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking","modified":"2026-07-07T17:56:57.889099913Z","packages":[{"ecosystem":"PyPI","name":"transformers","purl":"pkg:pypi/transformers","ranges":["<4.51.0"],"fixed":["4.51.0"]}]},{"id":"PYSEC-2026-1987","url":"https://osv.dev/vulnerability/PYSEC-2026-1987","summary":"Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking","modified":"2026-07-07T17:48:14.368851118Z","packages":[{"ecosystem":"PyPI","name":"transformers","purl":"pkg:pypi/transformers","ranges":["<4.51.0"],"fixed":["4.51.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}