CVE-2025-3263

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_configuration_file()` function within the `transformers.configuration_utils` module. The affected version is 4.49.0, and the issue is resolved in version 4.51.0. The vulnerability arises from the use of a regular expression pattern `config\.(.*)\.json` that can be exploited to cause excessive CPU consumption through crafted input strings, leading to catastrophic backtracking. This can result in model serving disruption, resource exhaustion, and increased latency in applications using the library.

• CWE-1333

• https://github.com/huggingface/transformers/commit/0720e206c6ba28887e4d60ef60a6a089f6c1cc76Patch
• https://huntr.com/bounties/c7a69150-54f8-4e81-8094-791e7a2a0f29Exploit, Third Party Advisory

Published

Jul 7, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-32624Missing Authorization vulnerability in czater Czater.pl – li…7.1
• CVE-2025-32625Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2025-32626Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2025-32627Improper Control of Filename for Include/Require Statement i…8.1
• CVE-2025-32628Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2025-32629Improper Limitation of a Pathname to a Restricted Directory …8.6
• CVE-2025-32630Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2025-32631Improper Limitation of a Pathname to a Restricted Directory …8.6
• CVE-2025-32632Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2025-32633Improper Limitation of a Pathname to a Restricted Directory …8.6
• CVE-2025-32634Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2025-32635Insertion of Sensitive Information Into Sent Data vulnerabil…7.5