← signals
2026-07-26·HUGGINGFACE·security risk
lowdown

On 2026-07-07, OSV published 12 new advisories for the Hugging Face Transformers library, including multiple ReDoS...

On 2026-07-07, OSV published 12 new advisories for the Hugging Face Transformers library, including multiple ReDoS (CVE-2025-3933, CVE-2025-3262, CVE-2025-6921, CVE-2025-6638, CVE-2024-12720, CVE-2025-5197, CVE-2025-1194, CVE-2025-3264, CVE-2025-3263, CVE-2025-6051) and one deserialization vulnerability (CVE-2024-3568), plus an input validation issue (CVE-2025-3777).

window 15devidence 88confidence score 100

confidence score

Strong evidence: 3 independent source classes support this read.

100
low confidence3 independent source classesothermarketpasses publish gate

signal brief

On 2026-07-07, OSV published 12 new advisories for the Hugging Face Transformers library, including multiple ReDoS (CVE-2025-3933, CVE-2025-3262, CVE-2025-6921, CVE-2025-6638, CVE-2024-12720, CVE-2025-5197, CVE-2025-1194, CVE-2025-3264, CVE-2025-3263, CVE-2025-6051) and one deserialization vulnerability (CVE-2024-3568), plus an input validation issue (CVE-2025-3777). These affect core components: DonutProcessor, AdamWeightDecay optimizer, MarianTokenizer, get_imports(), and get_configuration_file. While the CVEs were assigned in 2024-2025, their publication in a single batch suggests a coordinated disclosure or security audit. The cluster indicates potential systemic issues in the library's regex handling and input sanitization, which could impact the entire ecosystem that relies on Transformers. As Hugging Face maintains the library, this raises developer trust concerns and could slow adoption if users perceive the platform as insecure. No exploit evidence is available yet, but the volume of issues is notable.

What the sources said

  • OSV advisory PYSEC-2026-1977: "Transformers is vulnerable to ReDoS attack through its DonutProcessor class" (source).
  • OSV advisory PYSEC-2026-1978: "Transformers Deserialization of Untrusted Data vulnerability" (source).
  • OSV advisory PYSEC-2026-1987: "Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking" (source).

source data used

Decision support, not stock advice. This signal is research with cited evidence — not a recommendation to buy, sell, or hold any security.