GHSA-59p9-h35m-wg4g
Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| PyPI | transformers | < 4.53.0 | 4.53.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's `remove_language_code()` method. This vulnerability is present in version 4.52.4 and has been fixed in version 4.53.0. The issue arises from inefficient regex processing, which can be exploited by crafted input strings containing malformed language code patterns, leading to excessive CPU consumption and potential denial of service.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2025-6638
- https://github.com/huggingface/transformers/commit/47c34fba5c303576560cb29767efb452ff12b8be
- https://github.com/huggingface/transformers/commit/d37f7517972f67e3f2194c000ed0f87f064e5099
- https://github.com/huggingface/transformers
- https://huntr.com/bounties/6a6c933f-9ce8-4ded-8b3b-2c1444c61f36