EUVD-2025-21126
GHSA-37mw-44qp-f5jm
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V2 - Validation and Business Logic Regex complexity limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Service disruption affecting availability. In critical infrastructure, DoS can have cascading effects on dependent systems. With a CVSS score of 5.3 (MEDIUM), this represents a moderate risk. |
| Exploit ScenarioDerived | An attacker sends specially crafted requests that cause excessive resource consumption (CPU, memory, disk) or trigger a crash in the target application. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 16, 2026
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor class's token2json() method. This vulnerability affects versions 4.50.3 and earlier, and is fixed in version 4.52.1. The issue arises from the regex pattern <s_(.*?)> which can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. This vulnerability can lead to service disruption, resource exhaustion, and potential API service vulnerabilities, impacting document processing tasks using the Donut model.
Earlier versions of this analysis (1)
RemediationAI
A vendor patch is available — apply it immediately. Implement rate limiting and input validation. Use timeout mechanisms for resource-intensive operations. Deploy DDoS protection where applicable.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in pypi, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
A denial of service vulnerability allows an attacker to disrupt the normal functioning of a system, making it unavailable to legitimate users. This vulnerability is classified as Inefficient Regular Expression Complexity (ReDoS) (CWE-1333).
Know when Hugging Face gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3Executive ViewAI
CVE-2025-3933 presents moderate security risk rated CVSS 5.3. Exploitation could compromise the security of affected deployments. Proof-of-concept code is publicly available. A patch is available and should be applied during regular vulnerability management.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Hugging Face
View allThe huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
Arbitrary Python code execution in LMDeploy 0.12.1 through 0.12.2 lets an attacker who publishes a malicious model on Hu
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36. Rated high severity (CVSS
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36. Rated high severity (CVSS
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository,
The huggingface/transformers library, versions prior to 4.53.0, is vulnerable to Regular Expression Denial of Service (R
Path traversal in Hugging Face Datasets up to 5.0.0 allows attackers to read arbitrary local files when a victim process
Path traversal in Hugging Face Accelerate through 1.14.0 exposes two distinct attack outcomes when a user loads a crafte
Server-side request forgery in HuggingFace text-generation-inference through version 3.3.7 enables unauthenticated remot
A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, spe
Remote code execution in Hugging Face Transformers 5.2.0 allows a malicious model repository to bypass the user's explic
XPath injection in Hugging Face Smolagents 1.20.0 lets an attacker who can influence the text passed to the vision web b
Exploit-DB