PT-2025-28152 · Hugging Face · Huggingface/Transformers

CVE-2025-3264 · Published 2025-03-17 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions: Hugging Face Transformers versions 4.49.0 through 4.50.0

Description: A Regular Expression Denial of Service (ReDoS) vulnerability exists in the Hugging Face Transformers library, specifically within the get imports() function of dynamic module utils.py. The issue stems from a regular expression pattern s*trys*:.*?except.*?: used to filter try/except blocks from Python code. This pattern is susceptible to catastrophic backtracking, allowing crafted input strings to cause excessive CPU consumption. This can lead to remote code loading disruption, resource exhaustion in model serving, supply chain attack vectors, and development pipeline disruption.

Recommendations: Update to version 4.51.0 or later to resolve this issue.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

BDU:2026-03547

CVE-2025-3264

GHSA-JJPH-296X-MRCR

PYSEC-2026-1985

Affected Products

Huggingface/Transformers

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/3xxx/CVE-2025-3264.json · Exploit
• 🔥 https://huntr.com/bounties/3c6f7822-9992-476d-8cf0-b0b1623427df · Exploit
• https://github.com/huggingface/transformers/commit/0720e206c6ba28887e4d60ef60a6a089f6c1cc76 · Patch
• https://osv.dev/vulnerability/CVE-2025-3264 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03547 · Security Note
• https://osv.dev/vulnerability/GHSA-jjph-296x-mrcr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3264 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-1985 · Vendor Advisory
• https://github.com/huggingface/transformers · Note
• https://github.com/huggingface/transformers/commit/126abe3461762e5fc180e7e614391d1b4ab051ca · Note
• https://github.com/advisories/GHSA-jjph-296x-mrcr · Note
• https://t.me/cveNotify/131186 · Telegram Post
• https://pypi.org/project/transformers · Note
• https://twitter.com/CVEnew/status/1942166383850033444 · Twitter Post