Advisoriesby IbisTransformersGHSA-59p9-h35m-wg4g
Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer
Fix: upgrade to 4.53.0 or later
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's remove_language_code() method. This vulnerability is present in version 4.52.4 and has been fixed in version 4.53.0. The issue arises from inefficient regex processing, which can be exploited by crafted input strings containing malformed language code patterns, leading to excessive CPU consumption and potential denial of service.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| transformers PyPI | < 4.53.0 | 4.53.0 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-1333
- Also known as
- CVE-2025-6638, PYSEC-2026-1981
More Transformers advisories
All Transformers
Transformers: denial of serviceCVE-2025-6921fixed in 4.53.0Hugging Face Transformers library has Regular Expression Denial of ServiceCVE-2025-6051fixed in 4.53.0Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerabilityCVE-2025-5197fixed in 4.53.0Transformers is vulnerable to ReDoS attack through its DonutProcessor classCVE-2025-3933fixed in 4.52.1Transformers vulnerable to ReDoS attack through its SETTING_RE variableCVE-2025-3262fixed in 4.51.0Transformers vulnerable to ReDoS attack through its get_imports() functionCVE-2025-3264fixed in 4.51.0