{"data":{"id":"0e0ea467-9346-4e69-b297-30ffffb6e0ba","title":"CVE-2025-3264: A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library…","summary":"A Regular Expression Denial of Service (ReDoS) flaw in the `get_imports()` function within `dynamic_module_utils.py` of the Hugging Face Transformers library affects version 4.49.0. The regex `\\s*try\\s*:.*?except.*?:`, used to filter try/except blocks from Python code, can be driven into catastrophic backtracking by crafted input strings, causing excessive CPU consumption. The source says this can disrupt remote code loading, exhaust resources in model serving, and enable supply chain attacks and development pipeline disruption.","solution":"Fixed in version 4.51.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-3264","publishedAt":"2025-07-07T14:15:27.500Z","cveId":"CVE-2025-3264","cweIds":["CWE-1333"],"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["transformers@< 4.51.0 (fixed: 4.51.0)"],"affectedPackageNames":["transformers"],"affectedPackageRefs":["pypi:transformers"],"affectedVendors":["HuggingFace"],"affectedVendorsRaw":["Hugging Face Transformers"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Hugging Face Transformers ReDoS in get_imports() regex parsing","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00496,"epssCheckedAt":"2026-11-04T18:09:13.788Z","kevDateAdded":null,"advisoryAliases":["GHSA-jjph-296x-mrcr"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:53:27.814Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-04-05T20:08:47.475Z","daysToFix":-93,"fixCheckedAt":"2026-10-29T21:44:11.984Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"transformers","fixedVersion":"4.51.0","matchedVersion":"4.51.0","fixReleasedAt":"2025-04-05T20:08:47.475Z","daysToFix":-93,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:44:11.833Z"}]}}