CVE-2025-3262

Affected versions of the Hugging Face Transformers package are vulnerable to Regular Expression Denial of Service (ReDoS) due to inefficient regex patterns in multiple components. The vulnerable regular expressions in `serve.py`, `user.py`, and `utils.py` fail to handle catastrophic backtracking efficiently when processing specially crafted input strings, allowing exponential time complexity. A remote attacker can exploit this vulnerability by providing malicious input strings that cause excessive CPU consumption during regex matching operations, resulting in a denial of service. The vulnerability was fixed by refactoring the problematic regex patterns to use more efficient alternatives. The fix replaces complex regex operations with simpler string manipulation methods, implements input validation before regex processing, and rewrites patterns to avoid nested quantifiers and catastrophic backtracking. Specifically, the commit modifies regex handling in the model serving components and user input processing functions to prevent ReDoS attacks.