Transformers vulnerable to ReDoS attack through its get_imports() function

🗓️ 07 Jul 2026 16:02:56Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 7 Views

ReDoS in get_imports() enables CPU exhaustion from crafted input; affects v4.49.0, fixed v4.51.0.

Reporter	Title	Published	Views	Family All 23
huntr	Regular expression Denial of Service - ReDoS	17 Mar 202516:10	–	huntr
ibm	Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to denial of service and improper input validation [CVE-2025-3262] [CVE-2025-3263] [CVE-2025-3264] [CVE-2025-3777]	9 Jul 202517:38	–	ibm
ibm	Security Bulletin: Multiple Security vulnerabilities affecting IBM Knowledge Catalog Standard Cartridge	25 Mar 202619:31	–	ibm
ibm	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Denial of Service in huggingface/transformers [CVE-2025-3262, CVE-2025-3264, CVE-2025-3933, CVE-2025-3263]	31 Oct 202518:45	–	ibm
bdu_fstec	The vulnerability of the get_imports() function in the Transformers library allows a hacker to trigger a service failure.	24 Mar 202600:00	–	bdu_fstec
cgr	CVE-2025-3264 vulnerabilities	14 Jan 202601:17	–	cgr
circl	CVE-2025-3264	7 Jul 202512:05	–	circl
cnnvd	Hugging Face Transformers 安全漏洞	7 Jul 202500:00	–	cnnvd
cve	CVE-2025-3264	7 Jul 202509:55	–	cve
cvelist	CVE-2025-3264 Regular Expression Denial of Service (ReDoS) in huggingface/transformers	7 Jul 202509:55	–	cvelist

Vulners

Node

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-3264
github	www.github.com/huggingface/transformers/commit/0720e206c6ba28887e4d60ef60a6a089f6c1cc76
github	www.github.com/huggingface/transformers/commit/126abe3461762e5fc180e7e614391d1b4ab051ca
github	www.github.com/huggingface/transformers
huntr	www.huntr.com/bounties/3c6f7822-9992-476d-8cf0-b0b1623427df
pypi	www.pypi.org/project/transformers
github	www.github.com/advisories/GHSA-jjph-296x-mrcr

07 Jul 2026 17:25Current

6.4Medium risk

Vulners AI Score6.4

CVSS 35.3

EPSS0.00431

SSVC