PT-2025-37307 · Hugging Face · Huggingface/Transformers

CVE-2025-6638 · Published 2025-09-12 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Hugging Face Transformers versions prior to 4.53.0

Description: A Regular Expression Denial of Service (ReDoS) vulnerability exists in the Hugging Face Transformers library, specifically affecting the remove language code() method within the MarianTokenizer. This issue arises from inefficient regular expression processing, which can be exploited by crafted input strings containing malformed language code patterns, leading to excessive CPU consumption and potential denial of service.

Recommendations: Update to version 4.53.0 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2025-6638

GHSA-59P9-H35M-WG4G

PYSEC-2026-1981

Affected Products

Huggingface/Transformers

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/6xxx/CVE-2025-6638.json · Exploit
• 🔥 https://huntr.com/bounties/6a6c933f-9ce8-4ded-8b3b-2c1444c61f36 · Exploit
• https://github.com/huggingface/transformers/commit/47c34fba5c303576560cb29767efb452ff12b8be · Patch
• https://osv.dev/vulnerability/CVE-2025-6638 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-59p9-h35m-wg4g · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-1981 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6638 · Security Note
• https://github.com/huggingface/transformers · Note
• https://github.com/huggingface/transformers/commit/d37f7517972f67e3f2194c000ed0f87f064e5099 · Note
• https://pypi.org/project/transformers · Note
• https://twitter.com/CVEnew/status/1966459988135825608 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1966470120852611174 · Twitter Post
• https://github.com/advisories/GHSA-59p9-h35m-wg4g · Note
• https://t.me/CVEtracker/32369 · Telegram Post