GitHub Advisoryadvisory · PyPI

GHSA-59p9-h35m-wg4g Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer

MEDIUM Published 2025-09-12 Modified 2025-09-15 Official page ↗
Aliases
CVE-2025-6638
Ecosystem
PyPI
Packages
transformers
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-1333
Reviewed
2025-09-15

Affected packages

• PyPI transformers: < 4.53.0 → fixed in 4.53.0

Description

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's `remove_language_code()` method. This vulnerability is present in version 4.52.4 and has been fixed in version 4.53.0. The issue arises from inefficient regex processing, which can be exploited by crafted input strings containing malformed language code patterns, leading to excessive CPU consumption and potential denial of service.

Related

Alias · CVE (1)

  • CVE-2025-6638 A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically… vulnerability

Weakness · CWE (1)

  • CWE-1333 Inefficient Regular Expression Complexity weakness

References