Executive brief
Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer
Affected products
- PyPI transformers
Junglewise Threat Intelligence
CVE-2025-6638: PYSEC-2026-1981 - Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer
CVE-2025-6638 · Severity: low · CVSS 3 · Published 2026-07-07
Technologies: transformers (PyPI). Vendors: PyPI.
Related threats
- A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. Th
- PYSEC-2026-1980 - Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer
- PYSEC-2026-1988 - Hugging Face Transformers library has Regular Expression Denial of Service
- PYSEC-2026-1983 - Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability
- PYSEC-2026-1977 - Transformers is vulnerable to ReDoS attack through its DonutProcessor class