{
 "id": "AIR-2025-0321",
 "slug": "cve-2025-5197-hugging-face-transformers-redos-vulnerability",
 "title": "CVE-2025-5197: Hugging Face Transformers ReDoS Vulnerability",
 "summary": "A Regular Expression Denial of Service vulnerability exists in Hugging Face Transformers during TensorFlow weight name conversion. Crafted inputs can trigger catastrophic backtracking, resulting in excessive CPU consumption and service disruption.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Transformers"
 ],
 "incident_date": "2025-08-06",
 "incident_date_precision": "day",
 "first_reported": "2025-08-06",
 "sources": [
  {
   "url": "https://github.com/advisories/GHSA-9356-575x-2w9m",
   "publisher": "GitHub Advisory Database",
   "title": "CVE-2025-5197: Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability",
   "published_at": "2025-08-06"
  },
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5197",
   "publisher": "NVD",
   "title": "CVE-2025-5197: A Regular Expression Denial of Service (ReDoS) vulnerability exists in the Hugging Face Transformers library, specifically in the…",
   "published_at": "2025-08-06"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_ghsa",
 "tags": [
  "CVE-2025-5197",
  "huggingface",
  "redos"
 ],
 "created_at": "2026-10-18T07:00:14.101Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}