{"action":"Upgrade transformers to 4.51.0 or later.","affected":[{"fixed":"4.51.0","introduced":"0"}],"component":"transformers","cve_ids":["CVE-2025-3263"],"ecosystem":"PyPI","epss":0.00496,"exploited":false,"fixed_versions":["4.51.0"],"ghsa_id":"GHSA-q2wp-rjmx-x6x9","id":"tcs_01M5KGWV6RE7RJGA4Z325Y173P","modified_at":"2026-07-07T17:48:14.368851118Z","published_at":"2026-07-07T16:02:56.816500Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1987","https://nvd.nist.gov/vuln/detail/CVE-2025-3263","https://github.com/huggingface/transformers/commit/0720e206c6ba28887e4d60ef60a6a089f6c1cc76","https://github.com/huggingface/transformers/commit/126abe3461762e5fc180e7e614391d1b4ab051ca","https://github.com/huggingface/transformers","https://huntr.com/bounties/c7a69150-54f8-4e81-8094-791e7a2a0f29","https://pypi.org/project/transformers","https://github.com/advisories/GHSA-q2wp-rjmx-x6x9"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"PYSEC-2026-1987","url":"https://osv.dev/vulnerability/PYSEC-2026-1987"}],"summary":"Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking"}