Executive brief
Transformers vulnerable to ReDoS attack through its get_imports() function
Affected products
- PyPI transformers
Junglewise Threat Intelligence
CVE-2025-3264: PYSEC-2026-1985 - Transformers vulnerable to ReDoS attack through its get_imports() function
CVE-2025-3264 · Severity: low · CVSS 3 · Published 2026-07-07
Technologies: transformers (PyPI). Vendors: PyPI.
Related threats
- A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. Th
- PYSEC-2026-1980 - Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer
- PYSEC-2026-1988 - Hugging Face Transformers library has Regular Expression Denial of Service
- PYSEC-2026-1981 - Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer
- PYSEC-2026-1983 - Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability