CVE-2025-3264

What it actually does

The flaw is a Regular Expression Denial of Service issue in Hugging Face Transformers 4.49.0, in the get_imports() function in dynamic_module_utils.py. When Transformers processes dynamically loaded Python code, the regular expression used to remove try/except blocks can enter catastrophic backtracking on specially crafted input. This can pin a Python worker CPU core for an extended period, block model-loading workflows, delay or fail remote-code import analysis, and degrade model-serving or development automation that loads untrusted or externally sourced model code.

Why it matters to the business

Organizations using affected Transformers versions in model serving, ML pipelines, CI/CD, notebooks, or automated model ingestion can experience service slowdowns, failed deployments, stuck workers, increased compute cost, and disruption to AI application availability. The risk is most relevant where systems load models or custom code from external repositories, user-supplied model packages, or internal supply-chain workflows. Public exploitation is not currently known, the CVSS score is moderate, EPSS is low, and the issue is not in CISA KEV, but the library is widely used in AI stacks, so remediation should be prioritized for externally exposed or automated model-loading environments.

How an attack unfolds

An attacker first needs a path to cause an affected Transformers installation to inspect or load crafted Python module content, typically through a model repository, custom model code, plugin-like ML artifact, or other source consumed by from_pretrained-style workflows with dynamic or remote code handling. The attacker places Python source containing patterns that interact badly with the vulnerable try/except filtering expression. When the victim system evaluates imports using get_imports(), the regex engine spends excessive time backtracking instead of completing normally. The result is CPU exhaustion or a hung worker during model loading, which can cause timeouts, failed inference startup, pipeline disruption, or cascading availability issues if orchestration repeatedly retries the failing load.

How to fix it

Upgrade Hugging Face Transformers to version 4.51.0 or later. For source-based deployments, ensure the code includes the upstream fix at commit 0720e206c6ba28887e4d60ef60a6a089f6c1cc76. Remove or rebuild containers, notebooks, virtual environments, and ML pipeline images that pin Transformers 4.49.0. Where immediate upgrade is not possible, reduce exposure by disabling or tightly controlling dynamic remote-code loading, avoiding trust of unreviewed model repositories, enforcing allowlists for model sources, running model-loading tasks with CPU and wall-clock limits, and isolating model ingestion from production inference capacity.

How to confirm the fix worked

Confirm that all runtime environments, container images, build pipelines, notebooks, and dependency lockfiles use transformers 4.51.0 or later, or contain commit 0720e206c6ba28887e4d60ef60a6a089f6c1cc76. Validate with package inventory commands such as pip show transformers, pip freeze, poetry show transformers, conda list transformers, or software composition analysis. Inspect installed source for the vulnerable dynamic_module_utils.py implementation and ensure the vulnerable regex is no longer present. Perform a controlled model-loading test using representative approved model repositories and verify there are no excessive CPU spikes, timeouts, or hangs during dynamic module import processing.

Typical attack path

1. Identify a target workflow that uses Hugging Face Transformers 4.49.0 and loads model code or artifacts from external or user-influenced sources.
2. Publish, submit, or otherwise introduce a crafted model repository or Python module containing source text designed to trigger catastrophic regex backtracking in dynamic_module_utils.py.
3. Cause the target service, pipeline, notebook, or CI job to load or inspect the crafted model or module.
4. The vulnerable get_imports() function processes the crafted source and the regex consumes excessive CPU.
5. Model loading stalls or fails, workers become unavailable, and dependent inference or development workflows experience denial of service.

How to detect it

To determine whether this was already exploited, review telemetry from systems that load or inspect Hugging Face model repositories or custom model code. Focus on periods where new or externally sourced models were introduced. Examine application logs from model-serving services, CI/CD jobs, notebooks, orchestration platforms, and ingestion workers for model-load hangs, repeated timeouts, watchdog kills, or sudden worker restarts. Correlate those events with host and container metrics showing sustained high CPU in Python processes without corresponding successful model startup. Review network, repository, and artifact-access logs for recently accessed model repositories or Python modules that preceded the CPU spike. If stack traces, core dumps, py-spy captures, faulthandler output, or APM traces are available, look for execution stuck in Python regex processing from transformers.dynamic_module_utils.get_imports. Inspect suspect model repositories or cached dynamic modules for unusual try/except-heavy or malformed Python source intended to stress parsing. There are no known public threat actors or ransomware campaigns associated with this issue, so detection should emphasize behavioral evidence of denial-of-service during dynamic model loading rather than fixed malware indicators.

• transformers==4.49.0
• transformers/dynamic_module_utils.py
• dynamic_module_utils.py
• get_imports(
• \\s*try\\s*:.*?except.*?:
• trust_remote_code=True
• transformers.dynamic_module_utils
• AutoModel.from_pretrained
• AutoTokenizer.from_pretrained
• from_pretrained(
• TimeoutError
• ReadTimeout
• CPU time limit exceeded
• Worker timeout
• Killed worker
• faulthandler
• re.search
• re.sub

What your security team should do

• Inventory all environments that use Hugging Face Transformers, especially model-serving platforms, CI/CD jobs, notebooks, container images, and automated model-ingestion systems.
• Prioritize upgrades for systems that load models or custom code from external, user-submitted, partner-supplied, or frequently changing repositories.
• Upgrade to Transformers 4.51.0 or later, or verify inclusion of commit 0720e206c6ba28887e4d60ef60a6a089f6c1cc76 in source builds.
• Search dependency lockfiles and container images for transformers==4.49.0 and rebuild affected artifacts.
• Restrict use of dynamic remote-code loading to approved repositories and require review before enabling trust of custom model code.
• Apply CPU, memory, and execution-time limits to model-loading workers so a single crafted artifact cannot exhaust shared production resources.
• Monitor historical model-loading failures, high CPU events, and timeouts around workflows that processed newly introduced or untrusted model code.