Skip to main content

Inefficient Regular Expression Complexity

CVE-2025-3933

Medium
5.3/10

Summary

A Regular Expression Denial-of-Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the "DonutProcessor" class's "token2json()" method. This vulnerability affects versions through 4.51.3, and is fixed in version 4.52.0. The issue arises from the regex pattern "<s_(.*?)>" which can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. This vulnerability can lead to service disruption, resource exhaustion, and potential API service vulnerabilities, impacting document processing tasks using the Donut model.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • LOW

CWE-1333 - Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

References

Advisory Timeline

  • Published