PT-2025-37307 · Hugging Face · Huggingface/Transformers

CVE-2025-6638 · Publicado 2025-09-12 · Atualizado 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Hugging Face Transformers versions prior to 4.53.0

Description: A Regular Expression Denial of Service (ReDoS) vulnerability exists in the Hugging Face Transformers library, specifically affecting the remove language code() method within the MarianTokenizer. This issue arises from inefficient regular expression processing, which can be exploited by crafted input strings containing malformed language code patterns, leading to excessive CPU consumption and potential denial of service.

Recommendations: Update to version 4.53.0 or later.

Exploit

Correção

DoS

Enumeração de Fraquezas

CWE-1333

Identificadores relacionados

CVE-2025-6638

GHSA-59P9-H35M-WG4G

PYSEC-2026-1981

Produtos afetados

Huggingface/Transformers

Referências · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/6xxx/CVE-2025-6638.json · Exploit
• 🔥 https://huntr.com/bounties/6a6c933f-9ce8-4ded-8b3b-2c1444c61f36 · Exploit
• https://github.com/huggingface/transformers · Nota
• https://github.com/huggingface/transformers/commit/d37f7517972f67e3f2194c000ed0f87f064e5099 · Nota
• https://github.com/huggingface/transformers/commit/47c34fba5c303576560cb29767efb452ff12b8be · Correção
• https://osv.dev/vulnerability/CVE-2025-6638 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-59p9-h35m-wg4g · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2026-1981 · Aviso do Fabricante
• https://pypi.org/project/transformers · Nota
• https://twitter.com/CVEnew/status/1966459988135825608 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1966470120852611174 · Publicação no Twitter
• https://github.com/advisories/GHSA-59p9-h35m-wg4g · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-6638 · Nota de Segurança
• https://t.me/CVEtracker/32369 · Publicação no Telegram