CVE-2025-6921: Transformers ReDoS — HIGH

CISO Take

Any ML platform exposing fine-tuning or training configuration to external users (SaaS fine-tuning APIs, MLOps platforms) is at risk if attackers can supply weight decay regex patterns. The vulnerability causes 100% CPU utilization with no authentication required per the CVSS vector. Patch immediately to transformers 4.53.0 and audit any interface that accepts optimizer configuration from untrusted inputs.

What is the risk?

CVSS 7.5 High but EPSS 0.00032 indicates very low observed exploitation in the wild. Actual organizational risk is bifurcated: low for closed training environments where only authorized ML engineers control optimizer configs, and high for cloud-based fine-tuning services, AutoML platforms, or any API where external users can supply training hyperparameters. The network-exploitable, no-auth CVSS vector reflects the worst-case scenario where optimizer configs are exposed via API—organizations must assess whether their deployment matches that threat model.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Transformers	pip	—	No patch
161.8K OpenSSF 6.4 8.3K dependents Pushed 4d ago 40% patched ~92d to patch Full package profile →
Transformers	pip	< 4.53.0	`4.53.0`
161.8K OpenSSF 6.4 8.3K dependents Pushed 4d ago 40% patched ~92d to patch Full package profile →

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 37% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I None

A High

What should I do?

5 steps

PATCH

Upgrade transformers to >= 4.53.0 immediately (patch commit 47c34fb).
AUDIT

Inventory all services that accept optimizer configuration (include_in_weight_decay, exclude_from_weight_decay) from external or untrusted inputs.
VALIDATE

If patching is not immediately feasible, apply input validation—reject any regex pattern containing catastrophic backtracking constructs (nested quantifiers, alternation with overlap).
ISOLATE

Run training jobs in resource-constrained containers with CPU quotas to limit blast radius.
DETECT

Alert on training jobs with >95% CPU utilization persisting beyond expected warmup phase.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS Framework Training Data AML.T0010.001 - AI Software AML.T0029 - Denial of AI Service AML.T0034 - Cost Harvesting AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

6.1.2 - AI risk treatment 8.4 - AI system operation

NIST AI RMF

MANAGE-2.2 - Mechanisms to sustain the value of deployed AI MAP-5.2 - Practices and personnel for AI risk management

OWASP LLM Top 10

LLM04 - Model Denial of Service

Frequently Asked Questions

What is CVE-2025-6921?

Any ML platform exposing fine-tuning or training configuration to external users (SaaS fine-tuning APIs, MLOps platforms) is at risk if attackers can supply weight decay regex patterns. The vulnerability causes 100% CPU utilization with no authentication required per the CVSS vector. Patch immediately to transformers 4.53.0 and audit any interface that accepts optimizer configuration from untrusted inputs.

Is CVE-2025-6921 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-6921, increasing the risk of exploitation.

How to fix CVE-2025-6921?

1. PATCH: Upgrade transformers to >= 4.53.0 immediately (patch commit 47c34fb). 2. AUDIT: Inventory all services that accept optimizer configuration (include_in_weight_decay, exclude_from_weight_decay) from external or untrusted inputs. 3. VALIDATE: If patching is not immediately feasible, apply input validation—reject any regex pattern containing catastrophic backtracking constructs (nested quantifiers, alternation with overlap). 4. ISOLATE: Run training jobs in resource-constrained containers with CPU quotas to limit blast radius. 5. DETECT: Alert on training jobs with >95% CPU utilization persisting beyond expected warmup phase.

What systems are affected by CVE-2025-6921?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, fine-tuning workflows, MLOps platforms, model serving with online fine-tuning, AutoML services.

What is the CVSS score for CVE-2025-6921?

CVE-2025-6921 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.47%.

What is the AI security impact?

Affected AI Architectures

training pipelinesfine-tuning workflowsMLOps platformsmodel serving with online fine-tuningAutoML services

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0029 Denial of AI Service

AML.T0034 Cost Harvesting

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: 6.1.2, 8.4

NIST AI RMF: MANAGE-2.2, MAP-5.2

OWASP LLM Top 10: LLM04

What are the technical details?

Original Advisory

The huggingface/transformers library, versions prior to 4.53.0, is vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer. The vulnerability arises from the _do_use_weight_decay method, which processes user-controlled regular expressions in the include_in_weight_decay and exclude_from_weight_decay lists. Malicious regular expressions can cause catastrophic backtracking during the re.search call, leading to 100% CPU utilization and a denial of service. This issue can be exploited by attackers who can control the patterns in these lists, potentially causing the machine learning task to hang and rendering services unresponsive.

Exploitation Scenario

An attacker with access to a fine-tuning API or MLOps platform sends a training job request with a malicious regex pattern such as '(a+)+$' in the include_in_weight_decay parameter. When the AdamWeightDecay optimizer's _do_use_weight_decay method calls re.search() against parameter names, catastrophic backtracking triggers and pegs the training process at 100% CPU. In a shared GPU cluster, this hangs all co-located training jobs. In a pay-per-use fine-tuning SaaS, it drives up compute costs and blocks legitimate customers—achieving DoS without any authentication.

Weaknesses (CWE)

CWE-400 Uncontrolled Resource Consumption Primary CWE-400 Uncontrolled Resource Consumption

CWE-400 — Uncontrolled Resource Consumption: The product does not properly control the allocation and maintenance of a limited resource.

[Architecture and Design] Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
[Architecture and Design] Mitigation of resource exhaustion attacks requires that the target system either: The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question. The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker. recognizes the attack and denies that user further access for a given amount of time, or uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.

Source: MITRE CWE corpus.