CVE-2025-5197

What it actually does

CVE-2025-5197 is a Regular Expression Denial of Service vulnerability in Hugging Face Transformers affecting versions up to 4.51.3. The vulnerable code is in convert_tf_weight_name_to_pt_weight_name(), which converts TensorFlow weight names to PyTorch-style names. A regex pattern used during parsing can exhibit catastrophic backtracking when processing specially crafted weight-name strings, causing a Python worker or model-conversion process to consume excessive CPU. The flaw does not directly enable code execution or data disclosure, but it can block threads or processes, degrade API responsiveness, and disrupt model-loading or conversion workflows that accept or process untrusted model metadata, checkpoint names, or weight names.

Why it matters to the business

Organizations using affected Transformers versions in model-serving, model-conversion, registry, CI/CD, or automated ML pipeline workflows may experience service slowdowns, stuck jobs, failed deployments, or denial of service if crafted input reaches the vulnerable conversion logic. The overall public exploitation signal is currently low, with EPSS at 0.00391 and no CISA KEV listing or known ransomware association, but the issue is easy to trigger wherever untrusted model artifacts or conversion requests are accepted. Because Transformers is widely embedded in ML tooling and downstream container packages, exposure may exist indirectly through packaged applications such as zot builds that include the vulnerable dependency.

How an attack unfolds

An attacker needs a path to supply or influence TensorFlow-style weight names or model artifacts that are passed into the Transformers TensorFlow-to-PyTorch conversion helper. They craft input containing patterns that interact poorly with the vulnerable regex used by convert_tf_weight_name_to_pt_weight_name(). When the application attempts to load, inspect, convert, or validate the supplied model data, the regex engine spends excessive time backtracking. This ties up CPU in the Python process performing the conversion, which may cause request timeouts, blocked worker pools, failed model-import jobs, autoscaling pressure, or broader service degradation if repeated across concurrent requests or pipeline jobs. Exploitation is most plausible against services that allow users to upload models, fetch remote model repositories, trigger format conversion, or submit model metadata for processing.

How to fix it

Upgrade Hugging Face Transformers to a fixed release. For source/Git users, update to commit 944b56000be5e9b61af8301aa340838770ad8a0b or later; for package-based deployments, use a release containing the fix, such as Transformers 4.53.0 or later. For affected downstream packages, upgrade zot Chainguard to 2.1.7-r2 or later and zot Wolfi to 2.1.7-r2 or later. If immediate upgrade is not possible, restrict who can trigger model conversion, avoid processing untrusted TensorFlow model artifacts, impose request/job CPU and wall-clock timeouts, isolate conversion workers from production-serving workers, cap model metadata and weight-name lengths, and rate-limit model upload or conversion endpoints.

How to confirm the fix worked

Confirm that no deployed environment is running Hugging Face Transformers version 4.51.3 or earlier by checking package metadata, container image SBOMs, lockfiles, and runtime imports. Validate that zot Chainguard and Wolfi packages are at 2.1.7-r2 or later where applicable. In Python environments, run a version check such as importing transformers and printing transformers.__version__, then verify it is 4.53.0 or later. For source builds, confirm the deployed code includes commit 944b56000be5e9b61af8301aa340838770ad8a0b or the equivalent regex fix. Operationally, test that model-conversion jobs enforce timeouts and that oversized or suspicious weight-name metadata is rejected or safely handled without sustained CPU spikes.

Typical attack path

1. Identify an application, API, notebook service, model registry, CI job, or conversion workflow using Hugging Face Transformers up to 4.51.3.
2. Find an input path where TensorFlow checkpoint names, layer names, model metadata, or uploaded model artifacts are processed by Transformers conversion code.
3. Submit a crafted weight-name string or model artifact designed to trigger excessive regex backtracking in convert_tf_weight_name_to_pt_weight_name().
4. Cause the affected Python process to spend excessive CPU during regex evaluation.
5. Repeat or parallelize requests/jobs to exhaust worker capacity, delay model processing, or disrupt dependent services.

How to detect it

Look for evidence of denial-of-service activity rather than compromise persistence. Review application logs, API gateway logs, model registry logs, CI/CD job logs, notebook service logs, container logs, and process telemetry for repeated model upload, model import, or TensorFlow-to-PyTorch conversion attempts followed by high CPU, timeouts, worker restarts, or failed jobs. Focus on events involving Transformers conversion code, especially stack traces or log messages mentioning convert_tf_weight_name_to_pt_weight_name or modeling_tf_pytorch_utils.py. Search request bodies, artifact metadata, checkpoint index files, and validation logs for unusually long weight or layer names containing triple underscores. In endpoint or container telemetry, look for Python processes consuming sustained CPU without corresponding I/O, repeated SIGKILL/OOM/time-limit terminations, orchestrator restarts, or autoscaling events around conversion workloads. Because there are no known public threat actors or KEV activity for this issue, prioritize correlation of suspicious input patterns with resource exhaustion rather than looking for malware-specific artifacts.

• convert_tf_weight_name_to_pt_weight_name
• modeling_tf_pytorch_utils.py
• site-packages/transformers/modeling_tf_pytorch_utils.py
• /[^/]*___([^/]*)/
• ___
• transformers==4.51.3
• transformers==4.51.2
• transformers==4.51.1
• transformers==4.51.0
• TensorFlow-to-PyTorch conversion
• convert_tf_checkpoint_to_pytorch
• python
• python3
• CPU time limit exceeded
• TimeoutError
• Worker timeout
• Killed
• SIGKILL
• KeyboardInterrupt

What your security team should do

• Inventory all applications, containers, notebooks, CI jobs, and ML services that include Hugging Face Transformers or downstream packages embedding it.
• Prioritize upgrades for internet-facing or multi-tenant systems that accept model uploads, remote model references, or user-triggered conversion jobs.
• Upgrade Transformers to 4.53.0 or later, or deploy the fixed source commit 944b56000be5e9b61af8301aa340838770ad8a0b; upgrade zot Chainguard/Wolfi packages to 2.1.7-r2 or later.
• Add CPU, memory, and wall-clock limits to model-conversion and model-ingestion workers, and separate them from latency-sensitive inference services.
• Restrict model-conversion functionality to trusted users and trusted model sources until all affected components are remediated.
• Add monitoring for repeated conversion failures, long-running Python processes, high CPU saturation, and request timeouts associated with model upload or conversion workflows.
• Review historical logs for suspicious model-conversion requests or artifacts containing unusually long weight names with triple-underscore patterns.