CVE-2025-6638CWE-1333

Regular Expression Denial of Service (ReDoS) in huggingface/transformers

Medium · published September 12, 2025

CVSS v3.0
5.3
EPSS
1%
Percentile
43.9
In the wild
Unconfirmed
What it is

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's `remove_language_code()` method. This vulnerability is present in version 4.52.4 and has been fixed in version 4.53.0. The issue arises from inefficient regex processing, which can be exploited by crafted input strings containing malformed language code patterns, leading to excessive CPU consumption and potential denial of service.

The record
Technical detail
CVSS v3.0
5.3 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00529 · 43.9th percentile
Weakness
CWE-1333 · Inefficient Regular Expression Complexity
Published
2025-09-12T10:46Z
EPSS history
Timeline
  • 12 SEP 10:46Z
    Regular Expression Denial of Service (ReDoS) in huggingface/transformers
    cvelistv5