{"action":"Upgrade transformers to 4.51.0 or later.","affected":[{"fixed":"4.51.0","introduced":"4.49.0"}],"component":"transformers","cve_ids":["CVE-2025-3262"],"ecosystem":"PyPI","epss":0.00494,"exploited":false,"fixed_versions":["4.51.0"],"ghsa_id":"GHSA-489j-g2vx-39wf","id":"tcs_01M5KGWSP8JGG4RE2Q5TK7HXD8","modified_at":"2026-07-07T17:48:13.616945161Z","published_at":"2026-07-07T16:02:56.726858Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1979","https://nvd.nist.gov/vuln/detail/CVE-2025-3262","https://github.com/huggingface/transformers/commit/0720e206c6ba28887e4d60ef60a6a089f6c1cc76","https://github.com/huggingface/transformers/commit/126abe3461762e5fc180e7e614391d1b4ab051ca","https://github.com/huggingface/transformers","https://huntr.com/bounties/ecf5ccc4-39e7-4fb3-b547-14a41d31a184","https://pypi.org/project/transformers","https://github.com/advisories/GHSA-489j-g2vx-39wf"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"PYSEC-2026-1979","url":"https://osv.dev/vulnerability/PYSEC-2026-1979"}],"summary":"Transformers vulnerable to ReDoS attack through its SETTING_RE variable"}