Listen to this Post
The vulnerability, CVE-2025-XXXXX, exists in the `_do_use_weight_decay` method of the `AdamWeightDecay` optimizer within the Hugging Face Transformers library. This method determines if a parameter name should have weight decay applied by checking it against user-configurable lists of regular expression patterns: `include_in_weight_decay` and exclude_from_weight_decay. The function uses Python’s `re.search()` to match the parameter name against these patterns. If an attacker can supply a malicious regular expression, particularly one with a complex pattern susceptible to catastrophic backtracking, a specially crafted parameter name can trigger excessive computation. This causes the regular expression engine to enter a long-running loop, consuming 100% of a CPU core and leading to a denial of service condition, stalling the ML training process.
Platform: Hugging Face Transformers
Version: < 4.53.0
Vulnerability: ReDoS
Severity: Moderate
date: 2025-09-23
Prediction: Patch expected 2025-09-30
What Undercode Say:
`grep -n “_do_use_weight_decay” transformers/optimization.py`
`python -c “import re; re.search(‘^(a+)+$’, ‘aaaaaaaaaaaaaaaaaaaaaaaaaaaa!’)”`
`pip list | grep transformers`
How Exploit:
Attacker controls `include_in_weight_decay` list.
Inserts a malicious regex pattern.
Calls optimizer with a matching parameter name.
Triggers catastrophic backtracking in `re.search`.
Protection from this CVE
Upgrade to version 4.53.0.
Sanitize user-supplied regex patterns.
Use timeouts for regex evaluation.
Impact:
High CPU utilization.
Denial of Service.
Training process hang.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
