Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer

CAO 7.5CVE-2025-6638 · GHSA-59p9-h35m-wg4g · PYSEC-2026-1981 · Công bố 12/09/2025 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2025-6638 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng transformers, transformers (huggingface).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.56%, cao hơn 46.3% các lỗ hổng khác.
Cách xử lý: cập nhật lên 4.53.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
transformers PyPI	`< 4.53.0`	`4.53.0`
transformers huggingface	`= 4.52.4`	Chưa có bản vá

Mô tả

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's remove_language_code() method. This vulnerability is present in version 4.52.4 and has been fixed in version 4.53.0. The issue arises from inefficient regex processing, which can be exploited by crafted input strings containing malformed language code patterns, leading to excessive CPU consumption and potential denial of service.

Mô tả của NVD

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's `remove_language_code()` method. This vulnerability is present in version 4.52.4 and has been fixed in version 4.53.0. The issue arises from inefficient regex processing, which can be exploited by crafted input strings containing malformed language code patterns, leading to excessive CPU consumption and potential denial of service.