CVE-2025-3262: Transformers Package Vulnerable to ReDoS Attack via SETTING_RE Variable
Summary
CVE-2025-3262: Transformers vulnerable to ReDoS attack through its SETTING_RE variable. Affects transformers versions >= 4.49.0, < 4.51.0. Fixed in 4.51.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Transformers package, developed by Hugging Face, is a widely used library for natural language processing tasks. It provides pre-trained models and tools to facilitate the implementation of state-of-the-art machine learning models. However, version 4.49.0 of the package contains a vulnerability that exposes applications to potential denial-of-service attacks due to inefficient regular expressions.
Vulnerability Detail
A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers repository, specifically in version 4.49.0. The issue arises from the complexity of the regular expression used in the SETTING_RE variable within the transformers/commands/chat.py file. This regex employs repetition groups and non-optimized quantifiers, which can lead to exponential backtracking when processing input strings that are 'almost matching.' As a result, applications may experience significant performance degradation, and in extreme cases, a denial-of-service (DoS) condition may occur when handling specially crafted input.
How To Fix
Latest published version: 5.20.2 as of 22 Oct 2026
pip install --upgrade "transformers==5.20.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.51.0
This is the first release that contains the fix.
pip install --upgrade "transformers==4.51.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to restrict the types of strings processed by the application. This can help mitigate the risk of triggering the vulnerability. For example, you can limit the length and character set of input strings before they reach the vulnerable regex.
Conclusion
The vulnerability identified in the Transformers package (CVE-2025-3262) poses a risk of denial-of-service attacks due to inefficient regular expressions. It is crucial for users to update to version 4.51.0 or later to mitigate this risk. Implementing input validation can serve as a temporary workaround while awaiting an upgrade.
See every vulnerability recorded for transformers →
FAQ
A ReDoS (Regular Expression Denial of Service) attack exploits inefficient regular expressions to cause excessive backtracking, leading to performance degradation or application crashes.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of severity.
If an immediate upgrade is not possible, implement input validation to restrict the types of strings processed by the application as a temporary workaround.
You can find more information about the Transformers package on its official GitHub repository at https://github.com/huggingface/transformers.
References
Related vulnerabilities
Recent vulnerabilities recorded for transformers.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
