Executive Summary

This vulnerability is a Regular Expression Denial of Service (ReDoS) in the huggingface/transformers library versions prior to 4.53.0. It occurs in the AdamWeightDecay optimizer's _do_use_weight_decay method, which processes user-controlled regular expressions in the include_in_weight_decay and exclude_from_weight_decay lists. Maliciously crafted regular expressions can cause catastrophic backtracking during the re.search call, leading to 100% CPU usage and causing the system to hang or become unresponsive.

Useful 0 Not Useful 0

Impact Analysis

An attacker who can control the regular expression patterns in the include_in_weight_decay and exclude_from_weight_decay lists can exploit this vulnerability to cause the machine learning task to hang by consuming all CPU resources. This results in a denial of service, making the affected services unresponsive and potentially disrupting operations that rely on the huggingface/transformers library.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade the huggingface/transformers library to version 4.53.0 or later, where the issue has been fixed. Avoid using untrusted or user-controlled regular expressions in the include_in_weight_decay and exclude_from_weight_decay lists of the AdamWeightDecay optimizer to prevent potential ReDoS attacks.

Useful 0 Not Useful 0