CVE-2025-5197

Name of the Vulnerable Software and Affected Versions Hugging Face Transformers versions up to 4.51.3

Description A Regular Expression Denial of Service (ReDoS) vulnerability exists in the convert tf weight name to pt weight name() function of the Hugging Face Transformers library. This function, which converts TensorFlow weight names to PyTorch format, utilizes a regular expression pattern /[^/]* ([^/]*)/ susceptible to exploitation. Crafted input strings can trigger catastrophic backtracking, leading to excessive CPU consumption. This issue can result in service disruption, resource exhaustion, and potential vulnerabilities in API services that rely on model conversion between TensorFlow and PyTorch formats.

Recommendations Update to Hugging Face Transformers version 4.53.0 or later.