CVE-2025-3263

What it actually does

The flaw is a Regular Expression Denial of Service condition in Hugging Face Transformers 4.49.0 in the get_configuration_file() function in transformers.configuration_utils. The vulnerable regular expression, config\.(.*)\.json, can exhibit catastrophic backtracking when evaluated against specially crafted configuration-like file names or paths. If an application allows untrusted model repositories, model artifacts, file listings, or user-controlled model identifiers to reach this code path, a single crafted input can consume excessive CPU while the Python process evaluates the regex, causing request latency, worker starvation, model loading failures, or service unavailability. The issue is availability-focused and does not directly provide code execution, data disclosure, or privilege escalation.

Why it matters to the business

Organizations using affected Transformers versions in model-serving, inference APIs, batch ML pipelines, or automated model-loading workflows may experience degraded performance or outages if attackers can influence model configuration file names or repositories processed by the service. The practical consequence is interrupted AI/ML functionality, increased latency, failed inference jobs, higher compute costs from CPU exhaustion, and possible cascading failures in systems that depend on model availability. The CVSS score is moderate, EPSS is currently low, it is not listed in CISA KEV, and no exploit maturity is reported, so this should be prioritized based on exposure of untrusted model inputs rather than treated as an emergency internet-wide compromise scenario.

How an attack unfolds

An attacker first identifies an application or workflow that uses Hugging Face Transformers 4.49.0 and loads model configuration files from a location the attacker can influence, such as a submitted model repository, uploaded model bundle, externally referenced model path, or automated integration that scans third-party model artifacts. The attacker then supplies a model artifact or file listing containing a deliberately malformed configuration-style name that causes the vulnerable config\.(.*)\.json regex to backtrack heavily while get_configuration_file() searches for a matching configuration file. When the application attempts to load or inspect the model, the Python process spends excessive CPU time in regex evaluation. Repeated submissions or concurrent requests can tie up inference workers, slow down model initialization, exhaust CPU capacity, and produce denial-of-service conditions without requiring authentication bypass or code execution.

How to fix it

Upgrade Hugging Face Transformers to a fixed release. The issue is described as resolved in version 4.51.0, and the provided fixed source commit is 0720e206c6ba28887e4d60ef60a6a089f6c1cc76. For package-based deployments, pin transformers to 4.51.0 or later and rebuild affected containers, virtual environments, notebooks, serverless functions, and ML runtime images. For source-based deployments, ensure the installed code includes commit 0720e206c6ba28887e4d60ef60a6a089f6c1cc76 or a later equivalent fix. As compensating controls, restrict loading of untrusted model repositories, validate or bound file name lengths in model artifacts, reject suspiciously long configuration-style file names, isolate model loading in resource-limited workers, set CPU and request timeouts, and avoid automatically loading arbitrary third-party model content in production services.

How to confirm the fix worked

Confirm the installed Transformers version in every runtime that loads models, not only in source repositories. Use package inventory, container image scans, SBOMs, and runtime checks such as python -c "import transformers; print(transformers.__version__)" to verify that affected environments are no longer on 4.49.0 and are running 4.51.0 or later. For source installs, verify the repository contains commit 0720e206c6ba28887e4d60ef60a6a089f6c1cc76 or inspect transformers/configuration_utils.py to confirm the vulnerable regex behavior has been removed or made safe. Validate operationally by running controlled model-loading tests with unusually long or malformed configuration-like file names in a non-production environment and confirming CPU use remains bounded, requests time out safely, and worker processes recover normally.

Typical attack path

1. Find an application, API, notebook service, CI pipeline, or inference platform that uses Hugging Face Transformers 4.49.0.
2. Determine whether the service loads or inspects model artifacts, model repositories, or configuration file names influenced by external users.
3. Submit or reference a crafted model artifact containing configuration-like file names designed to trigger excessive regex backtracking.
4. Cause the vulnerable get_configuration_file() code path in transformers.configuration_utils to process the crafted names during model loading or inspection.
5. Consume CPU in the affected Python process, increasing latency or blocking worker threads/processes.
6. Repeat or parallelize requests to create sustained model-serving disruption or broader resource exhaustion.

How to detect it

To determine whether this was already exploited, review telemetry from services that load Hugging Face Transformers models, especially systems that accept user-submitted models, external repository references, uploaded model bundles, or automated third-party model ingestion. Focus on the period before remediation and look for unexplained CPU saturation in Python workers, model-loading requests that run far longer than normal, request timeouts, worker restarts, autoscaling events, queue buildup, and errors or stack traces referencing transformers.configuration_utils or get_configuration_file(). Correlate application logs, API gateway logs, object storage access logs, model registry audit logs, container orchestration events, APM traces, and host metrics. Suspicious patterns include repeated attempts to load the same unfamiliar model artifact, unusually long or malformed configuration-like file names, bursts of failed model initialization, and CPU-heavy Python processes without matching inference throughput. There are no public threat actors or ransomware campaigns reported for this issue in the provided data, so detection should emphasize behavioral evidence of denial-of-service attempts rather than known malware indicators.

• transformers.configuration_utils
• get_configuration_file
• transformers/configuration_utils.py
• config\.(.*)\.json
• Regular Expression Denial of Service
• catastrophic backtracking
• transformers==4.49.0
• huggingface/transformers:4.49.0

What your security team should do

• Inventory all applications, containers, notebooks, CI jobs, model-serving platforms, and batch ML workers using Hugging Face Transformers and identify any running version 4.49.0.
• Prioritize remediation for internet-facing inference services, shared notebook platforms, automated model ingestion pipelines, and any workflow that loads user-supplied or third-party model artifacts.
• Upgrade affected deployments to Transformers 4.51.0 or later, or ensure source deployments include commit 0720e206c6ba28887e4d60ef60a6a089f6c1cc76.
• Rebuild and redeploy base ML images so downstream services do not continue to inherit the vulnerable library.
• Temporarily disable or restrict automatic loading of untrusted model repositories until patched.
• Apply resource controls around model loading, including CPU limits, worker isolation, request timeouts, queue limits, and circuit breakers.
• Add monitoring for abnormal CPU spikes, repeated model-loading failures, and latency increases associated with Transformers model initialization.
• Review recent logs for suspicious bursts of model-loading requests or errors involving transformers.configuration_utils or get_configuration_file().