CVE-2025-6638

MEDIUM5.3EPSS 0.04%

Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer

發布日:2025/9/12修改日:2026/2/4

也稱為:GHSA-59p9-h35m-wg4gCGA-xw6g-7wm9-cvvg

描述

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's `remove_language_code()` method. This vulnerability is present in version 4.52.4 and has been fixed in version 4.53.0. The issue arises from inefficient regex processing, which can be exploited by crafted input strings containing malformed language code patterns, leading to excessive CPU consumption and potential denial of service.

受影響套件(1)

PyPI/transformersfrom 0, < 4.53.0

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM5.3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

參考連結(5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-6638
PATCHhttps://github.com/huggingface/transformers
WEBhttps://github.com/huggingface/transformers/commit/47c34fba5c303576560cb29767efb452ff12b8be
WEBhttps://github.com/huggingface/transformers/commit/d37f7517972f67e3f2194c000ed0f87f064e5099
WEBhttps://huntr.com/bounties/6a6c933f-9ce8-4ded-8b3b-2c1444c61f36