CVE-2025-3933CWE-1333

Regular Expression Denial of Service (ReDoS) in huggingface/transformers

Medium · published July 11, 2025

CVSS v3.0
5.3
EPSS
0%
Percentile
41.6
In the wild
Unconfirmed
What it is

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor class's `token2json()` method. This vulnerability affects versions 4.50.3 and earlier, and is fixed in version 4.52.1. The issue arises from the regex pattern `<s_(.*?)>` which can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. This vulnerability can lead to service disruption, resource exhaustion, and potential API service vulnerabilities, impacting document processing tasks using the Donut model.

The record
Technical detail
CVSS v3.0
5.3 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00496 · 41.6th percentile
Weakness
CWE-1333 · Inefficient Regular Expression Complexity
Published
2025-07-11T09:22Z
EPSS history
Timeline
  • 11 JUL 09:22Z
    Regular Expression Denial of Service (ReDoS) in huggingface/transformers
    cvelistv5