{"data":{"id":"4d5b25cf-a0ec-4f88-92ad-2167c7e4689c","title":"CVE-2025-3933: A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library…","summary":"CVE-2025-3933 is a Regular Expression Denial of Service (ReDoS) flaw in the Hugging Face Transformers library, within the `token2json()` method of the `DonutProcessor` class. It affects versions 4.50.3 and earlier. The regex `<s_(.*?)>` can be driven into catastrophic backtracking by crafted input strings, causing excessive CPU consumption, service disruption and resource exhaustion in document processing with the Donut model.","solution":"Fixed in 4.52.1.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-3933","publishedAt":"2025-07-11T14:15:22.293Z","cveId":"CVE-2025-3933","cweIds":["CWE-1333"],"cvssScore":"5.3","cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["transformers@<= 4.51.3 (fixed: 4.52.1)"],"affectedPackageNames":["transformers"],"affectedPackageRefs":["pypi:transformers"],"affectedVendors":["HuggingFace"],"affectedVendorsRaw":["Hugging Face Transformers","Donut model","DonutProcessor"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Hugging Face Transformers ReDoS in DonutProcessor token2json method","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00496,"epssCheckedAt":"2026-11-04T06:10:14.546Z","kevDateAdded":null,"advisoryAliases":["GHSA-37mw-44qp-f5jm"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:53:25.577Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-05-20T20:48:57.796Z","daysToFix":-52,"fixCheckedAt":"2026-10-29T21:44:08.582Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"transformers","fixedVersion":"4.52.1","matchedVersion":"4.52.1","fixReleasedAt":"2025-05-20T20:48:57.796Z","daysToFix":-52,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:44:08.431Z"}]}}