CVE-2025-6921: Regular Expression Denial of Service (ReDoS) in huggingface/transformers
The huggingface/transformers library, versions prior to 4.53.0, is vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer. The vulnerability arises from the douseweightdecay method, which processes user-controlled regular expressions in the includeinweightdecay and excludefromweightdecay lists. Malicious regular expressions can cause catastrophic backtracking during the re.search call, leading to 100% CPU utilization and a denial of service. This issue can be exploited by attackers who can control the patterns in these lists, potentially causing the machine learning task to hang and rendering services unresponsive.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6921?
CVE-2025-6921 has been classified as a severity level that poses a risk of denial of service due to regular expression processing.
How do I fix CVE-2025-6921?
To fix CVE-2025-6921, upgrade the Hugging Face transformers library to version 4.53.0 or later.
What impact does CVE-2025-6921 have on the Hugging Face transformers library?
CVE-2025-6921 can lead to potential denial of service by exploiting the regular expression processing in the AdamWeightDecay optimizer.
Which versions of Hugging Face transformers are affected by CVE-2025-6921?
CVE-2025-6921 affects all versions of Hugging Face transformers prior to 4.53.0.
Is user input involved in triggering CVE-2025-6921?
Yes, CVE-2025-6921 involves user-controlled regular expressions that can exploit the vulnerability.