CVE-2025-6638
High
Description
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's `remove_language_code()` method. This vulnerability is present in version 4.52.4 and has been fixed in version 4.53.0. The issue arises from inefficient regex processing, which can be exploited by crafted input strings containing malformed language code patterns, leading to excessive CPU consumption and potential denial of service.
SeverityHigh
CVSS7.5
Exploit probability—
ProductHuggingface Transformers
PublishedSep 12, 2025
First seenSep 12, 2025
Weakness typeCWE-1333CWE-1333
How to fix
Update
- transformers4.53.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| huggingface transformers | 4.52.4 | — |
| transformersPyPI | v < 4.53.0 | 4.53.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.