CVE-2025-3264: Regular Expression Denial of Service (ReDoS) in huggingface/transformers

Vulnerability summary

CVE-2025-3264 is a medium (CVSS 5.3) vulnerability in huggingface huggingface/transformers. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 42.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 07-07-2025
   PublishedVulnerability first disclosed.
2. 07-07-2025
   Last modifiedVulnerability information updated.

Description

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_imports()` function within `dynamic_module_utils.py`. This vulnerability affects versions 4.49.0 and is fixed in version 4.51.0. The issue arises from a regular expression pattern `\s*try\s*:.*?except.*?:` used to filter out try/except blocks from Python code, which can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. This vulnerability can lead to remote code loading disruption, resource exhaustion in model serving, supply chain attack vectors, and development pipeline disruption.

• CWE-1333Inefficient Regular Expression ComplexityThe product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.