{"action":"Upgrade transformers to 4.51.0 or later.","affected":[{"fixed":"4.51.0","introduced":"0"}],"component":"transformers","cve_ids":["CVE-2025-3264"],"ecosystem":"PyPI","epss":0.00496,"exploited":false,"fixed_versions":["4.51.0"],"ghsa_id":"GHSA-jjph-296x-mrcr","id":"tcs_01M5KGWTY7ZZP2J68ND0S2SS9E","modified_at":"2026-07-07T17:48:14.362198100Z","published_at":"2026-07-07T16:02:56.404197Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1985","https://nvd.nist.gov/vuln/detail/CVE-2025-3264","https://github.com/huggingface/transformers/commit/0720e206c6ba28887e4d60ef60a6a089f6c1cc76","https://github.com/huggingface/transformers/commit/126abe3461762e5fc180e7e614391d1b4ab051ca","https://github.com/huggingface/transformers","https://huntr.com/bounties/3c6f7822-9992-476d-8cf0-b0b1623427df","https://pypi.org/project/transformers","https://github.com/advisories/GHSA-jjph-296x-mrcr"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"PYSEC-2026-1985","url":"https://osv.dev/vulnerability/PYSEC-2026-1985"}],"summary":"Transformers vulnerable to ReDoS attack through its get_imports() function"}