{"data":{"id":"b0364e40-3c1a-417a-9828-f9bbb750f7f8","title":"CVE-2025-6638: A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library…","summary":"CVE-2025-6638 is a Regular Expression Denial of Service (ReDoS) flaw in the Hugging Face Transformers library, affecting the MarianTokenizer's `remove_language_code()` method in version 4.52.4. Inefficient regex processing lets crafted input strings containing malformed language code patterns drive excessive CPU consumption, which can cause a denial of service. The weakness is classified as CWE-1333, and the fix is reported in version 4.53.0.","solution":"Fixed in 4.53.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-6638","publishedAt":"2025-09-12T15:15:31.770Z","cveId":"CVE-2025-6638","cweIds":["CWE-1333"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["transformers@< 4.53.0 (fixed: 4.53.0)"],"affectedPackageNames":["transformers"],"affectedPackageRefs":["pypi:transformers"],"affectedVendors":["HuggingFace"],"affectedVendorsRaw":["Hugging Face Transformers","MarianTokenizer"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Hugging Face Transformers ReDoS in MarianTokenizer remove_language_code","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00555,"epssCheckedAt":"2026-11-04T12:08:35.257Z","kevDateAdded":null,"advisoryAliases":["GHSA-59p9-h35m-wg4g"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:52:46.452Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-06-26T16:10:51.505Z","daysToFix":-78,"fixCheckedAt":"2026-10-29T21:43:48.381Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.93,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"transformers","fixedVersion":"4.53.0","matchedVersion":"4.53.0","fixReleasedAt":"2025-06-26T16:10:51.505Z","daysToFix":-78,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:43:48.230Z"}]}}