CVE-2025-3262

CVE-2025-3262 is a Regular Expression Denial of Service (ReDoS) vulnerability affecting huggingface/transformers version 4.49.0. The flaw resides in the `SETTING_RE` regular expression within `transformers/commands/chat.py`, which contains inefficient patterns leading to exponential backtracking. This can be triggered by specially crafted input strings, causing application performance degradation and potential denial of service. The vulnerability has a CVSS score of 7.5 (HIGH), indicating a severe impact on availability (A:H) with no user interaction required (UI:N) and low attack complexity (AC:L) over the network (AV:N). While it does not allow for data compromise, it poses a significant risk to service uptime. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The CVE has received minimal community discussion and media coverage, suggesting a low level of public awareness at this time.