Export limit exceeded: 200099 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (5 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-5197 | 1 Huggingface | 1 Transformers | 2025-10-21 | 5.3 Medium |
| A Regular Expression Denial of Service (ReDoS) vulnerability exists in the Hugging Face Transformers library, specifically in the `convert_tf_weight_name_to_pt_weight_name()` function. This function, responsible for converting TensorFlow weight names to PyTorch format, uses a regex pattern `/[^/]*___([^/]*)/` that can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. The vulnerability affects versions up to 4.51.3 and is fixed in version 4.53.0. This issue can lead to service disruption, resource exhaustion, and potential API service vulnerabilities, impacting model conversion processes between TensorFlow and PyTorch formats. | ||||
| CVE-2025-2099 | 1 Huggingface | 1 Transformers | 2025-05-21 | 7.5 High |
| A vulnerability in the `preprocess_string()` function of the `transformers.testing_utils` module in huggingface/transformers version v4.48.3 allows for a Regular Expression Denial of Service (ReDoS) attack. The regular expression used to process code blocks in docstrings contains nested quantifiers, leading to exponential backtracking when processing input with a large number of newline characters. An attacker can exploit this by providing a specially crafted payload, causing high CPU usage and potential application downtime, effectively resulting in a Denial of Service (DoS) scenario. | ||||
| CVE-2023-2800 | 1 Huggingface | 1 Transformers | 2025-01-21 | 4.7 Medium |
| Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0. | ||||
| CVE-2023-7018 | 1 Huggingface | 1 Transformers | 2024-11-21 | 7.8 High |
| Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36. | ||||
| CVE-2023-6730 | 1 Huggingface | 1 Transformers | 2024-11-21 | 8.8 High |
| Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36. | ||||
Page 1 of 1.