Database/AI/ML frameworks & serving
Transformers: attacker-supplied weight-decay regex patterns hang the training process (ReDoS)
Impact
AdamWeightDecay's _do_use_weight_decay passes the include_in_weight_decay and exclude_from_weight_decay lists straight to re.search, so a pattern chosen to trigger catastrophic backtracking pins a core at 100% and the training step never returns. This matters only where those lists are not fixed by the operator - a shared training service that accepts user-supplied optimizer configuration. On a GPU cluster the practical cost is a job that holds its allocated GPUs while making no progress, burning reserved capacity until someone notices and kills it. No confidentiality or integrity impact; the record establishes availability only, and the NVD network vector overstates reach for the common case where configs come from trusted code.
Who can reach it
Anyone who can control the optimizer's weight-decay pattern lists - in practice a tenant submitting training configuration to a shared training service. Not reachable at all when those lists are hardcoded by the operator.
What to do
Upgrade the transformers library to 4.53.0 or later in the training image and restart affected jobs or the training service; no node maintenance is involved. Where an upgrade is not yet possible, validate or allowlist user-supplied regex patterns and enforce per-job wall-clock limits so a hung step releases its GPUs.
References
Related entries
- SGLang (`/server_info`): Endpoint returns API keys and SSL keyfile pathsCVE-2026-15977 · SGLang (`/server_info`)High
- SGLang (weight exfiltration): Two endpoints allow a remote attacker to pull model weights when no API key is setCVE-2026-15978 · SGLang (weight exfiltration)High
- NVIDIA Triton Inference Server: unauthenticated request triggers excessive iteration and hangs the serverCVE-2026-16497 · NVIDIA Triton Inference Server for LinuxHigh
- Keras (HDF5 external links): Arbitrary local file read during model loadCVE-2026-1669 · Keras (HDF5 external links)High
- OpenShift AI Data Science Pipelines Operator: predictable PRNG generates MariaDB and MinIO credentialsCVE-2026-18611 · Red Hat OpenShift AI Data Science Pipelines Operator (generated MariaDB and MinIO credentials)High
- MLflow: unauthenticated arbitrary file read via prompt-tagged model version source pathCVE-2026-2614 · MLflow tracking server (`_create_model_version` / model version artifact handler)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.