Resource exhaustion in Huggingface Huggingface/transformers
CVE-2025-6921
The huggingface/transformers library, versions prior to 4.53.0, is vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer. The vulnerability arises from the _do_use_weight_decay method, which processes user-controlled regular expressions in the include_in_weight_decay and exclude_from_weight_decay lists. Malicious regular expressions can cause catastrophic backtracking during the re.search call, leading to 100% CPU utilization and a denial of service. This issue can be exploited by attackers who can control the patterns in these lists, potentially causing the machine learning task to hang and rendering services unresponsive.
Vulnerability class: DoS (Denial of Service)
EPSS: 0.005 (41.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Huggingface Huggingface/transformers — versions unspecified
- Huggingface Transformers
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@huntr.dev (Exploit, Third Party Advisory)
- security@huntr.dev (Patch)
Frequently asked questions
- What is CVE-2025-6921?
- CVE-2025-6921 is a high-severity vulnerability in Huggingface Huggingface/transformers, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2025-09-23.
- How severe is CVE-2025-6921?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2025-6921 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.