Regular Expression Denial of Service in Hugging Face Transformers Library

CVE-2025-6638

What is CVE-2025-6638?

A Regular Expression Denial of Service (ReDoS) vulnerability has been identified in the Hugging Face Transformers library, impacting the functionality of the MarianTokenizer's 'remove_language_code()' method. This flaw is triggered by inefficient regular expression processing, allowing an attacker to exploit the vulnerability using crafted input strings with malformed language code patterns. Such exploitation can lead to significant CPU resource exhaustion, resulting in potential denial of service for the application. The vulnerability is resolved in version 4.53.0, highlighting the importance of updating to the latest version to mitigate this risk.

References