CVE-2025-3933

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor class's `token2json()` method. This vulnerability affects versions 4.50.3 and earlier, and is fixed in version 4.52.1. The issue arises from the regex pattern `<s_(.*?)>` which can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. This vulnerability can lead to service disruption, resource exhaustion, and potential API service vulnerabilities, impacting document processing tasks using the Donut model.

• CWE-1333

• https://github.com/huggingface/transformers/commit/ebbe9b12dd75b69f92100d684c47f923ee262a93Patch
• https://huntr.com/bounties/25282953-5827-4384-bb6f-5790d275721bExploit, Third Party Advisory

Published

Jul 11, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-3927Digigram's PYKO-OUT audio-over-IP (AoIP) web-server does not…9.8
• CVE-2025-3928Commvault Web Server has an unspecified vulnerability that c…8.8
• CVE-2025-3929An XSS issue was discovered in MDaemon Email Server version …6.1
• CVE-2025-3930Strapi uses JSON Web Tokens (JWT) for authentication. After …6.3
• CVE-2025-3931A flaw was found in Yggdrasil, which acts as a system broker…7.8
• CVE-2025-3932It was possible to craft an email that showed a tracking lin…6.5
• CVE-2025-39348Deserialization of Untrusted Data vulnerability in ThemeGood…9.8
• CVE-2025-39349Deserialization of Untrusted Data vulnerability in Potenzagl…9.8
• CVE-2025-3935ScreenConnect versions 25.2.3 and earlier versions may be su…7.2
• CVE-2025-39350Missing Authorization vulnerability in Rocket Apps wProject.…8.2
• CVE-2025-39351Cross-Site Request Forgery (CSRF) vulnerability in ThemeGood…4.3
• CVE-2025-39352Missing Authorization vulnerability in ThemeGoods Grand Rest…8.2