Last seen September 1, 2026

transformers Security Incident

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vulnerability is due to inefficient regular expression complexity in the `SETTING_RE` variable within the `transformers/commands/chat.py` file. The regex contains repetition groups and non-optimized quantifiers, leading to exponential backtracking when processing 'almost matching' payloads. This can degrade application performance and potentially result in a denial-of-service (DoS) when handling specially crafted input strings. The issue is fixed in version 4.51.0.

Technical Severity
Low severity
Lifecycle Status

RESOLVED

Sources

What Happened

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vulnerability is due to inefficient regular expression complexity in the `SETTING_RE` variable within the `transformers/commands/chat.py` file. The regex contains repetition groups and non-optimized quantifiers, leading to exponential backtracking when processing 'almost matching' payloads. This can degrade application performance and potentially result in a denial-of-service (DoS) when handling specially crafted input strings. The issue is fixed in version 4.51.0.

Why This Matters

Publisher reporting describes a security event affecting ReDoS. BugSkan could not yet bind a CVE or affected version, so treat the source details as the current record.

Recommended Action

Confirm whether ReDoS is present in your environment and review vendor guidance for this report. Apply available patches or mitigations if your deployment matches the described conditions.

Exposure

My Interests Exposure

Exposure unknown

Recommended Response
Last Seen

Sep 01, 2026 21:01

Exposure reason: This incident does not currently match a technology in My Interests.

Exploitation status: UNKNOWN

Primary entities:

transformersvulnerabilityReDoShuggingface/transformersversionversions

Timeline

  • Incident first seen
    Jul 07, 2025 18:00

    BugSkan first recorded this incident.

  • Transformers vulnerable to ReDoS attack through its SETTING_RE variable
    Jul 07, 2025 18:00

    OSV.dev · Research

  • Hugging Face Transformers downloads custom generation code before trust consent
    Sep 01, 2026 21:01

    GitHub Advisory Database · Vulnerability

  • Latest observed development
    Sep 01, 2026 21:01

    Most recent source or update associated with this incident.

Sources

Transformers vulnerable to ReDoS attack through its SETTING_RE variable

OSV.dev · Jul 07, 2025 18:00

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vulnerability is due to inefficient regular expression complexity in the `SETTING_RE` variable within the `transformers/commands/chat.py` file. The regex contains repetition groups and non-optimized quantifiers, leading to exponential backtracking when processing 'almost matching' payloads. This can degrade application performance and potentially result in a denial-of-service (DoS) when handling specially crafted input strings. The issue is fixed in version 4.51.0.

Open publisher source
Hugging Face Transformers downloads custom generation code before trust consent

GitHub Advisory Database · Sep 01, 2026 21:01

A vulnerability in Hugging Face Transformers (versions 4.49.0,

Open publisher source

Other BugSkan incidents that share identifiers, products, or vendors with this report.

My Interests Match

Want personalized relevance?

Create an account to see which incidents overlap with your interests.

← Back to incident intelligence