Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer

🗓️ 07 Jul 2026 16:03:05Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 8 Views

Hugging Face transformers prior to 4.53.0 have ReDoS in AdamWeightDecay via user controlled regex.

Reporter	Title	Published	Views	Family All 23
Huntr	Regular Expression Denial of Service (ReDoS) in AdamWeightDecay Optimizer	18 Jun 202513:55	–	huntr
BDU FSTEC	The vulnerability of the _do_use_weight_decay() function in the Hugging Face Transformers library, which allows a hacker to cause a service failure.	6 Oct 202500:00	–	bdu_fstec
Chainguard	CVE-2025-6921 vulnerabilities	16 Oct 202519:56	–	cgr
CNNVD	transformers 资源管理错误漏洞	23 Sep 202500:00	–	cnnvd
CVE	CVE-2025-6921	23 Sep 202513:56	–	cve
Cvelist	CVE-2025-6921 Regular Expression Denial of Service (ReDoS) in huggingface/transformers	23 Sep 202513:56	–	cvelist
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses transformers-4.51.3-py3-none-any.whl which is vulnerable to CVE-2025-6921.	4 Dec 202506:12	–	ibm
EUVD	EUVD-2025-30889	3 Oct 202520:07	–	euvd
Github Security Blog	Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer	23 Sep 202515:31	–	github
NVD	CVE-2025-6921	23 Sep 202514:15	–	nvd

Vulners

Node

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-6921
github	www.github.com/huggingface/transformers/commit/47c34fba5c303576560cb29767efb452ff12b8be
github	www.github.com/huggingface/transformers/commit/d37f7517972f67e3f2194c000ed0f87f064e5099
github	www.github.com/huggingface/transformers
huntr	www.huntr.com/bounties/287d15a7-6e7c-45d2-8c05-11e305776f1f
pypi	www.pypi.org/project/transformers
github	www.github.com/advisories/GHSA-4w7r-h757-3r74

07 Jul 2026 17:25Current

5.9Medium risk

Vulners AI Score5.9

CVSS 35.3

CVSS 3.17.5

EPSS0.00467

SSVC