TransformersGHSA-59p9-h35m-wg4g
Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer
Medium5.3CVE-2025-6638 · Published Sep 12, 2025 · updated Sep 10, 2026
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's `remove_language_code()` method. This vulnerability is present in version 4.52.4 and has been fixed in version 4.53.0. The issue arises from inefficient regex processing, which can be exploited by crafted input strings containing malformed language code patterns, leading to excessive CPU consumption and potential denial of service.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| transformers PyPI | < 4.53.0 | 4.53.0 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-1333
- Also known as
- CVE-2025-6638, PYSEC-2026-1981
More Transformers advisories
All Transformers| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 232025 | Transformers: denial of service Medium5.3Sep 23, 2025 | Medium5.3 | 4.53.0 |
| Sep 142025 | Hugging Face Transformers library has Regular Expression Denial of ServiceMedium5.3Sep 14, 2025 | Medium5.3 | 4.53.0 |
| Aug 62025 | Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerabilityMedium5.3Aug 6, 2025 | Medium5.3 | 4.53.0 |
| Jul 112025 | Transformers is vulnerable to ReDoS attack through its DonutProcessor classMedium5.3Jul 11, 2025 | Medium5.3 | 4.52.1 |
| Jul 72025 | Transformers vulnerable to ReDoS attack through its SETTING_RE variableMedium5.3Jul 7, 2025 | Medium5.3 | 4.51.0 |
| Jul 72025 | Transformers vulnerable to ReDoS attack through its get_imports() functionMedium5.3Jul 7, 2025 | Medium5.3 | 4.51.0 |