CVE-2025-6638: Regular Expression Denial of Service (ReDoS) in huggingface/transformers
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's removelanguagecode() method. This vulnerability is present in version 4.52.4 and has been fixed in version 4.53.0. The issue arises from inefficient regex processing, which can be exploited by crafted input strings containing malformed language code patterns, leading to excessive CPU consumption and potential denial of service.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6638?
CVE-2025-6638 is classified as a high severity Regular Expression Denial of Service vulnerability.
How do I fix CVE-2025-6638?
To fix CVE-2025-6638, upgrade the Hugging Face Transformers library to version 4.53.0 or later.
Which versions of the Hugging Face Transformers library are affected by CVE-2025-6638?
CVE-2025-6638 affects versions 4.52.4 and earlier of the Hugging Face Transformers library.
What component of the Hugging Face Transformers library is impacted by CVE-2025-6638?
CVE-2025-6638 impacts the MarianTokenizer's remove_language_code() method in the Hugging Face Transformers library.
Is CVE-2025-6638 a code execution vulnerability?
No, CVE-2025-6638 is a Denial of Service vulnerability and does not allow for code execution.