{"data":{"id":"9cad0738-578e-4caf-a88b-d2b5dcf6813b","title":"CVE-2025-5197: A Regular Expression Denial of Service (ReDoS) vulnerability exists in the Hugging Face Transformers library…","summary":"A Regular Expression Denial of Service (ReDoS) flaw exists in the Hugging Face Transformers library, in the `convert_tf_weight_name_to_pt_weight_name()` function that converts TensorFlow weight names to PyTorch format. Its regex pattern `/[^/]*___([^/]*)/` can be driven into catastrophic backtracking by crafted input strings, consuming excessive CPU. The flaw affects versions up to 4.51.3 and can cause service disruption, resource exhaustion and potential API service vulnerabilities during model conversion.","solution":"Fixed in version 4.53.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-5197","publishedAt":"2025-08-06T16:15:26.837Z","cveId":"CVE-2025-5197","cweIds":["CWE-1333"],"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["transformers@< 4.53.0 (fixed: 4.53.0)"],"affectedPackageNames":["transformers"],"affectedPackageRefs":["pypi:transformers"],"affectedVendors":["HuggingFace"],"affectedVendorsRaw":["Hugging Face Transformers"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Hugging Face Transformers ReDoS in TensorFlow to PyTorch weight name conversion","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00419,"epssCheckedAt":"2026-11-04T12:08:34.493Z","kevDateAdded":null,"advisoryAliases":["GHSA-9356-575x-2w9m"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:53:09.645Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-06-26T16:10:51.505Z","daysToFix":-41,"fixCheckedAt":"2026-10-29T21:43:59.300Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.93,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"transformers","fixedVersion":"4.53.0","matchedVersion":"4.53.0","fixReleasedAt":"2025-06-26T16:10:51.505Z","daysToFix":-41,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:43:59.149Z"}]}}