{"id":"CVE-2025-3262","aliases":["EUVD-2025-20217","GHSA-489j-g2vx-39wf","PYSEC-2026-1979"],"status":"published","title":"Regular Expression Denial of Service (ReDoS) in huggingface/transformers","description":"A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vulnerability is due to inefficient regular expression complexity in the `SETTING_RE` variable within the `transformers/commands/chat.py` file. The regex contains repetition groups and non-optimized quantifiers, leading to exponential backtracking when processing 'almost matching' payloads. This can degrade application performance and potentially result in a denial-of-service (DoS) when handling specially crafted input strings. The issue is fixed in version 4.51.0.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00494,"percentile":0.42777,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333"],"published":"2025-07-07T09:54:39Z","modified":"2026-10-28T02:30:50Z","fixes":[{"ecosystem":"PyPI","package":"transformers","fixed_in":["4.51.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"transformers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.49.0"},{"fixed":"4.51.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"transformers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.49.0"},{"fixed":"4.51.0"}]}],"versions":["4.49.0","4.50.0","4.50.1","4.50.2","4.50.3"]},{"source":"osv","ecosystem":"PyPI","package":"transformers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.49.0"},{"fixed":"4.51.0"}]}],"versions":["4.49.0","4.50.0","4.50.1","4.50.2","4.50.3"]}],"products":[{"vendor":"huggingface","product":"huggingface/transformers"},{"vendor":"huggingface","product":"transformers"}],"references":[{"url":"https://huntr.com/bounties/ecf5ccc4-39e7-4fb3-b547-14a41d31a184","tags":["exploit","Exploit","Third Party Advisory","web"]},{"url":"https://github.com/huggingface/transformers/commit/0720e206c6ba28887e4d60ef60a6a089f6c1cc76","tags":["Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3262","tags":["advisory"]},{"url":"https://github.com/huggingface/transformers/commit/126abe3461762e5fc180e7e614391d1b4ab051ca","tags":["web"]},{"url":"https://github.com/advisories/GHSA-489j-g2vx-39wf","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/3xxx/CVE-2025-3262.json","tags":["advisory"]},{"url":"https://github.com/huggingface/transformers","tags":["package"]},{"url":"https://pypi.org/project/transformers","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-3262","title":"Regular Expression Denial of Service (ReDoS) in huggingface/transformers","description":"A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vulnerability is due to inefficient regular expression complexity in the `SETTING_RE` variable within the `transformers/commands/chat.py` file. The regex contains repetition groups and non-optimized quantifiers, leading to exponential backtracking when processing 'almost matching' payloads. This can degrade application performance and potentially result in a denial-of-service (DoS) when handling specially crafted input strings. The issue is fixed in version 4.51.0.","status":"published","published":"2025-07-07T09:54:39.079Z","modified":"2025-07-07T15:19:42.413Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:32:39.039362Z"}],"euvd":[{"id":"EUVD-2025-20217","description":"A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vulnerability is due to inefficient regular expression complexity in the `SETTING_RE` variable within the `transformers/commands/chat.py` file. The regex contains repetition groups and non-optimized quantifiers, leading to exponential backtracking when processing 'almost matching' payloads. This can degrade application performance and potentially result in a denial-of-service (DoS) when handling specially crafted input strings. The issue is fixed in version 4.51.0.","status":"published","published":"2025-07-07T09:54:39Z","modified":"2025-07-07T15:19:42Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T20:32:13.402869Z"}],"ghsa":[{"id":"GHSA-489j-g2vx-39wf","title":"Transformers vulnerable to ReDoS attack through its SETTING_RE variable","description":"A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vulnerability is due to inefficient regular expression complexity in the `SETTING_RE` variable within the `transformers/commands/chat.py` file. The regex contains repetition groups and non-optimized quantifiers, leading to exponential backtracking when processing 'almost matching' payloads. This can degrade application performance and potentially result in a denial-of-service (DoS) when handling specially crafted input strings. The issue is fixed in version 4.51.0.","status":"published","published":"2025-07-07T12:30:22Z","modified":"2025-08-04T15:29:19Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:38:52.85141Z"}],"nvd":[{"id":"CVE-2025-3262","description":"A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vulnerability is due to inefficient regular expression complexity in the `SETTING_RE` variable within the `transformers/commands/chat.py` file. The regex contains repetition groups and non-optimized quantifiers, leading to exponential backtracking when processing 'almost matching' payloads. This can degrade application performance and potentially result in a denial-of-service (DoS) when handling specially crafted input strings. The issue is fixed in version 4.51.0.","status":"published","published":"2025-07-07T10:15:27.2Z","modified":"2026-06-17T09:19:32.77Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:11:16.997062Z"}],"osv":[{"id":"CVE-2025-3262","title":"Regular Expression Denial of Service (ReDoS) in huggingface/transformers","description":"A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vulnerability is due to inefficient regular expression complexity in the `SETTING_RE` variable within the `transformers/commands/chat.py` file. The regex contains repetition groups and non-optimized quantifiers, leading to exponential backtracking when processing 'almost matching' payloads. This can degrade application performance and potentially result in a denial-of-service (DoS) when handling specially crafted input strings. The issue is fixed in version 4.51.0.","status":"published","published":"2025-07-07T09:54:39.079Z","modified":"2026-10-28T02:30:50.015453202Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:44:48.02508Z"},{"id":"GHSA-489j-g2vx-39wf","title":"Transformers vulnerable to ReDoS attack through its SETTING_RE variable","description":"A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vulnerability is due to inefficient regular expression complexity in the `SETTING_RE` variable within the `transformers/commands/chat.py` file. The regex contains repetition groups and non-optimized quantifiers, leading to exponential backtracking when processing 'almost matching' payloads. This can degrade application performance and potentially result in a denial-of-service (DoS) when handling specially crafted input strings. The issue is fixed in version 4.51.0.","status":"published","published":"2025-07-07T12:30:22Z","modified":"2026-07-07T17:56:54.298553138Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:46:36.782754Z"},{"id":"PYSEC-2026-1979","title":"Transformers vulnerable to ReDoS attack through its SETTING_RE variable","description":"A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vulnerability is due to inefficient regular expression complexity in the `SETTING_RE` variable within the `transformers/commands/chat.py` file. The regex contains repetition groups and non-optimized quantifiers, leading to exponential backtracking when processing 'almost matching' payloads. This can degrade application performance and potentially result in a denial-of-service (DoS) when handling specially crafted input strings. The issue is fixed in version 4.51.0.","status":"published","published":"2026-07-07T16:02:56.726858Z","modified":"2026-07-07T17:48:13.616945161Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:55.537808Z"}]}}