CVE-2025-3933: CWE-1333 Inefficient Regular Expression Complexity in huggingface huggingface/transformers
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor class's `token2json()` method. This vulnerability affects versions 4.50.3 and earlier, and is fixed in version 4.52.1. The issue arises from the regex pattern `<s_(.*?)>` which can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. This vulnerability can lead to service disruption, resource exhaustion, and potential API service vulnerabilities, impacting document processing tasks using the Donut model.
CVE-2025-3933: CWE-1333 Inefficient Regular Expression Complexity in huggingface huggingface/transformers
Description
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor class's `token2json()` method. This vulnerability affects versions 4.50.3 and earlier, and is fixed in version 4.52.1. The issue arises from the regex pattern `<s_(.*?)>` which can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. This vulnerability can lead to service disruption, resource exhaustion, and potential API service vulnerabilities, impacting document processing tasks using the Donut model.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- @huntr_ai
- Date Reserved
- 2025-04-25T13:37:56.821Z
- Cvss Version
- 3.0
- State
- PUBLISHED
Threat ID: 6870dd5da83201eaacadb457
Added to database: 7/11/2025, 9:46:05 AM
Last updated: 7/11/2025, 9:46:05 AM
Views: 1
Related Threats
CVE-2025-50122: CWE-331 Insufficient Entropy in Schneider Electric EcoStruxure IT Data Center Expert
HighCVE-2025-50121: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Schneider Electric EcoStruxure IT Data Center Expert
CriticalCVE-2025-6438: CWE-611 Improper Restriction of XML External Entity Reference in Schneider Electric EcoStruxure IT Data Center Expert
MediumCVE-2025-6851: CWE-918 Server-Side Request Forgery (SSRF) in apos37 Broken Link Notifier
HighCVE-2025-6838: CWE-1236 Improper Neutralization of Formula Elements in a CSV File in apos37 Broken Link Notifier
MediumActions
Need enhanced features?
Contact root@offseq.com for Pro access with improved analysis and higher rate limits.