CVE-2025-5197

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the Hugging Face Transformers library, specifically in the `convert_tf_weight_name_to_pt_weight_name()` function. This function, responsible for converting TensorFlow weight names to PyTorch format, uses a regex pattern `/[^/]*___([^/]*)/` that can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. The vulnerability affects versions up to 4.51.3 and is fixed in version 4.53.0. This issue can lead to service disruption, resource exhaustion, and potential API service vulnerabilities, impacting model conversion processes between TensorFlow and PyTorch formats.

• CWE-1333

• https://github.com/huggingface/transformers/commit/944b56000be5e9b61af8301aa340838770ad8a0bPatch
• https://huntr.com/bounties/3f8b3fd0-166b-46e7-b60f-60dd9d2678bfExploit, Issue Tracking, Patch, Third Party Advisory
• https://huntr.com/bounties/3f8b3fd0-166b-46e7-b60f-60dd9d2678bfExploit, Issue Tracking, Patch, Third Party Advisory

Published

Aug 6, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-51962A HTML Injection vulnerability in the comment section of the…6.1
• CVE-2025-51965OURPHP thru 8.6.1 is vulnerable to Cross-Site Scripting (XSS…6.1
• CVE-2025-51966A cross-site scripting (XSS) vulnerability exists in the PDF…6.1
• CVE-2025-51967A Reflected Cross-site Scripting (XSS) vulnerability exists …6.1
• CVE-2025-51968A SQL Injection vulnerability exists in the action.php file …6.5
• CVE-2025-51969A SQL Injection vulnerability exists in the product.php page…6.5
• CVE-2025-51970A SQL Injection vulnerability exists in the action.php endpo…7.7
• CVE-2025-51971A reflected Cross-Site Scripting (XSS) vulnerability exists …5.4
• CVE-2025-51972A SQL Injection vulnerability exists in the login.php of Pun…6.5
• CVE-2025-5198A flaw was found in Stackrox, where it is vulnerable to Cros…5.4
• CVE-2025-51986An issue was discovered in the demo/LINUXTCP implementation …7.5
• CVE-2025-51989HTML injection vulnerability in the registration interface i…7