CVE-2025-6638
Last modified
CVE-2025-6638 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's `remove_language_code()` method. This vulnerability is present in version 4.52.4 and has been fixed in version 4.53.0. EPSS estimates a 0.48% chance of exploitation in the next 30 days.
Description
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's `remove_language_code()` method. This vulnerability is present in version 4.52.4 and has been fixed in version 4.53.0. The issue arises from inefficient regex processing, which can be exploited by crafted input strings containing malformed language code patterns, leading to excessive CPU consumption and potential denial of service.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Huggingface | Transformers | 4.52.4 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-6638?
How severe is CVE-2025-6638?
How do I fix CVE-2025-6638?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-66373Akamai Ghost on Akamai CDN edge servers before 2025-11-17 ha…4.8
- CVE-2025-66374CyberArk Endpoint Privilege Manager Agent through 25.10.0 al…7.8
- CVE-2025-66376Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before…6.1
- CVE-2025-66377Pexip Infinity before 39.0 has Missing Authentication for a …7.5
- CVE-2025-66378Pexip Infinity 38.0 and 38.1 before 39.0 has insufficient ac…7.5
- CVE-2025-66379Pexip Infinity before 39.0 has Improper Input Validation in …7.5
- CVE-2025-66382In libexpat through 2.7.3, a crafted file with an approximat…5.5
- CVE-2025-66384app/Controller/EventsController.php in MISP before 2.5.24 ha…8.2
- CVE-2025-66385UsersController::edit in Cerebrate before 1.30 allows an aut…9.4
- CVE-2025-66386app/Model/EventReport.php in MISP before 2.5.27 allows path …4.1
- CVE-2025-66388A vulnerability in Apache Airflow allowed authenticated UI u…6.5
- CVE-2025-66389GitHub Copilot 1.372.0 allows filesystem access outside of a…7.5
Are you affected by CVE-2025-6638?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST