GitHub Advisoryadvisory · PyPI

GHSA-37mw-44qp-f5jm Transformers is vulnerable to ReDoS attack through its DonutProcessor class

MEDIUM Published 2025-07-11 Modified 2025-08-07 Official page ↗
Aliases
CVE-2025-3933
Ecosystem
PyPI
Packages
transformers
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-1333
Reviewed
2025-07-11

Affected packages

• PyPI transformers: < 4.52.1 → fixed in 4.52.1

Description

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor class's `token2json()` method. This vulnerability affects versions 4.51.3 and earlier, and is fixed in version 4.52.1. The issue arises from the regex pattern `` which can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. This vulnerability can lead to service disruption, resource exhaustion, and potential API service vulnerabilities, impacting document processing tasks using the Donut model.

Related

Alias · CVE (1)

  • CVE-2025-3933 A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within… vulnerability

Weakness · CWE (1)

  • CWE-1333 Inefficient Regular Expression Complexity weakness

References