PT-2025-29223 · Hugging Face · Huggingface/Transformers

CVE-2025-3933 · Published 2025-04-05 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions: Hugging Face Transformers versions 4.50.3 and earlier Hugging Face Transformers version 4.52.1

Description: A Regular Expression Denial of Service (ReDoS) vulnerability exists in the Hugging Face Transformers library, specifically within the token2json() method of the DonutProcessor class. The issue stems from the regex pattern <s (.*?)> which can be exploited with crafted input strings, leading to catastrophic backtracking and excessive CPU consumption. This can result in service disruption and resource exhaustion, potentially impacting document processing tasks using the Donut model.

Recommendations: Hugging Face Transformers versions prior to 4.52.1 should be updated to version 4.52.1 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

BDU:2026-03546

CVE-2025-3933

GHSA-37MW-44QP-F5JM

PYSEC-2026-1977

Affected Products

Huggingface/Transformers

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/3xxx/CVE-2025-3933.json · Exploit
• 🔥 https://huntr.com/bounties/25282953-5827-4384-bb6f-5790d275721b · Exploit
• https://github.com/huggingface/transformers/commit/ebbe9b12dd75b69f92100d684c47f923ee262a93 · Patch
• https://bdu.fstec.ru/vul/2026-03546 · Security Note
• https://osv.dev/vulnerability/GHSA-37mw-44qp-f5jm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-3933 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-1977 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3933 · Security Note
• https://github.com/huggingface/transformers · Note
• https://github.com/huggingface/transformers/pull/37788 · Note
• https://twitter.com/VulmonFeeds/status/1943658568982331705 · Twitter Post
• https://twitter.com/CVEnew/status/1943668122223006096 · Twitter Post
• https://github.com/advisories/GHSA-37mw-44qp-f5jm · Note
• https://pypi.org/project/transformers · Note
• https://t.me/cvetracker/27549 · Telegram Post