Executive brief
Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking
Affected products
- PyPI transformers
Junglewise Threat Intelligence
CVE-2025-3263: PYSEC-2026-1987 - Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking
CVE-2025-3263 · Severity: low · CVSS 3 · Published 2026-07-07
Technologies: transformers (PyPI). Vendors: PyPI.
Related threats
- A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. Th
- PYSEC-2026-1980 - Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer
- PYSEC-2026-1988 - Hugging Face Transformers library has Regular Expression Denial of Service
- PYSEC-2026-1981 - Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer
- PYSEC-2026-1983 - Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability