CVE-2025-6921

The huggingface/transformers library, versions prior to 4.53.0, is vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer. The vulnerability arises from the _do_use_weight_decay method, which processes user-controlled regular expressions in the include_in_weight_decay and exclude_from_weight_decay lists. Malicious regular expressions can cause catastrophic backtracking during the re.search call, leading to 100% CPU utilization and a denial of service. This issue can be exploited by attackers who can control the patterns in these lists, potentially causing the machine learning task to hang and rendering services unresponsive.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/huggingface/transformers/commit/47c34fba5c303576560cb29767efb452ff12b8be	Patch
https://huntr.com/bounties/287d15a7-6e7c-45d2-8c05-11e305776f1f	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:huggingface:transformers:*:*:*:*:*:*:*:*

History

11 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) La biblioteca huggingface/transformers, versiones anteriores a la 4.53.0, es vulnerable a la Denegación de Servicio por Expresiones Regulares (ReDoS) en el optimizador AdamWeightDecay. La vulnerabilidad surge del método _do_use_weight_decay, que procesa expresiones regulares controladas por el usuario en las listas include_in_weight_decay y exclude_from_weight_decay. Expresiones regulares maliciosas pueden causar un retroceso catastrófico durante la llamada a re.search, lo que lleva a una utilización del 100% de la CPU y una denegación de servicio. Este problema puede ser explotado por atacantes que pueden controlar los patrones en estas listas, lo que podría causar que la tarea de aprendizaje automático se cuelgue y dejar los servicios sin respuesta.

Information

Published : 2025-09-23 14:15

Updated : 2026-10-11 20:10

NVD link : CVE-2025-6921

Mitre link : CVE-2025-6921

CVE.ORG link : CVE-2025-6921

JSON object : View

Products Affected

huggingface

transformers

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2025-6921", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-6921", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-23T14:56:14.042617Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@huntr.dev", "affectedData": [{"vendor": "huggingface", "product": "huggingface/transformers", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "4.53.0", "versionType": "custom"}]}]}], "published": "2025-09-23T14:15:41.387", "references": [{"url": "https://github.com/huggingface/transformers/commit/47c34fba5c303576560cb29767efb452ff12b8be", "tags": ["Patch"], "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/287d15a7-6e7c-45d2-8c05-11e305776f1f", "tags": ["Exploit", "Third Party Advisory"], "source": "security@huntr.dev"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "The huggingface/transformers library, versions prior to 4.53.0, is vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer. The vulnerability arises from the _do_use_weight_decay method, which processes user-controlled regular expressions in the include_in_weight_decay and exclude_from_weight_decay lists. Malicious regular expressions can cause catastrophic backtracking during the re.search call, leading to 100% CPU utilization and a denial of service. This issue can be exploited by attackers who can control the patterns in these lists, potentially causing the machine learning task to hang and rendering services unresponsive."}, {"lang": "es", "value": "La biblioteca huggingface/transformers, versiones anteriores a la 4.53.0, es vulnerable a la Denegaci\u00f3n de Servicio por Expresiones Regulares (ReDoS) en el optimizador AdamWeightDecay. La vulnerabilidad surge del m\u00e9todo _do_use_weight_decay, que procesa expresiones regulares controladas por el usuario en las listas include_in_weight_decay y exclude_from_weight_decay. Expresiones regulares maliciosas pueden causar un retroceso catastr\u00f3fico durante la llamada a re.search, lo que lleva a una utilizaci\u00f3n del 100% de la CPU y una denegaci\u00f3n de servicio. Este problema puede ser explotado por atacantes que pueden controlar los patrones en estas listas, lo que podr\u00eda causar que la tarea de aprendizaje autom\u00e1tico se cuelgue y dejar los servicios sin respuesta."}], "lastModified": "2026-10-11T20:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:huggingface:transformers:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "028A5B9B-4F6A-41A1-8A94-8F904334B237", "versionEndExcluding": "4.53.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}