5.3

CVSS Score

3.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-3262

CVE-2025-3262: Transformers vulnerable to ReDoS attack through its SETTING_RE variable

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vulnerability is due to inefficient regular expression complexity in the SETTING_RE variable within the transformers/commands/chat.py file. The regex contains repetition groups and non-optimized quantifiers, leading to exponential backtracking when processing 'almost matching' payloads. This can degrade application performance and potentially result in a denial-of-service (DoS) when handling specially crafted input strings. The issue is fixed in version 4.51.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-3262

CVE-2025-3262:

5.3

CVSS Score

3.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
transformers	pip	>= 4.49.0, < 4.51.0	4.51.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The core of the vulnerability lies in the use of inefficient regular expressions on untrusted user input, a classic ReDoS (Regular Expression Denial of Service) scenario. The primary function identified in the CVE, transformers.commands.chat.ChatCommand.run, used a complex regex (SETTING_RE) to parse chat commands, making it the main attack vector. An attacker could provide a malicious string that would cause the regex engine to enter a state of catastrophic backtracking, consuming excessive CPU and effectively causing a denial of service.\n\nThe security patch, found in commit 126abe3461762e5fc180e7e614391d1b4ab051ca, addresses this by completely removing the vulnerable regex and replacing it with a dedicated parsing function (is_valid_setting_command). This new function validates the input programmatically, which is not susceptible to ReDoS.\n\nFurthermore, the same commit fixed two other similar ReDoS vulnerabilities in get_configuration_file and get_imports. These functions also used potentially unsafe regular expressions on inputs (filenames and file content, respectively). The fixes similarly replaced regex matching with safer, more explicit logic, including using Python's Abstract Syntax Tree (ast) module for parsing code, which is the recommended practice for security and robustness.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.