CVE-2025-3933: Huggingface Transformers DoS Vulnerability

CVE-2025-3933 Overview

CVE-2025-3933 is a Regular Expression Denial of Service (ReDoS) vulnerability in the Hugging Face Transformers library. The flaw resides in the token2json() method of the DonutProcessor class, which parses output tokens from the Donut document understanding model. The regex pattern <s_(.*?)> is susceptible to catastrophic backtracking when processing crafted input strings. Attackers can trigger excessive CPU consumption without authentication, degrading or disrupting document processing services that use the Donut model. The vulnerability affects versions 4.50.3 and earlier and is fixed in version 4.52.1. This weakness is classified under [CWE-1333: Inefficient Regular Expression Complexity].

Critical Impact
Unauthenticated attackers can send crafted input to Donut-based document processing APIs to exhaust CPU resources and cause service disruption.

Affected Products

Hugging Face Transformers versions 4.50.3 and earlier
Applications using the DonutProcessor class for document processing
API services exposing Donut model inference endpoints

Discovery Timeline

2025-07-11 - CVE-2025-3933 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3933

Vulnerability Analysis

The vulnerability exists in src/transformers/models/donut/processing_donut.py within the token2json() method. This method iteratively scans model output tokens for start markers using the regex <s_(.*?)>. The lazy quantifier (.*?) combined with a broad character class creates conditions for catastrophic backtracking when the regex engine encounters pathological input.

When an attacker submits input containing many <s_ prefixes without matching closing angle brackets, the regex engine explores exponential combinations of matches. CPU utilization spikes as the engine performs backtracking on each character position. Because Donut is commonly deployed behind unauthenticated inference APIs for document OCR and structured extraction, a single malformed input can stall worker processes.

Root Cause

The root cause is the use of a backtracking-prone regex pattern in a hot code path processing untrusted model output tokens. The pattern <s_(.*?)> does not enforce a bounded character class or maximum length, allowing the regex engine to explore many possible match positions when the closing > is absent or ambiguous.

Attack Vector

An attacker sends a crafted document or token stream to any service invoking DonutProcessor.token2json(). No authentication or user interaction is required. The malicious payload contains a long sequence of <s_ tokens designed to trigger backtracking, causing sustained CPU exhaustion on the inference worker.

python

         output = {}
 
         while tokens:
-            start_token = re.search(r"<s_(.*?)>", tokens, re.IGNORECASE)
-            if start_token is None:
+            # We want r"<s_(.*?)>" but without ReDOS risk, so do it manually in two parts
+            potential_start = re.search(r"<s_", tokens, re.IGNORECASE)
+            if potential_start is None:
                 break
-            key = start_token.group(1)
+            start_token = tokens[potential_start.start() :]
+            if ">" not in start_token:
+                break
+            start_token = start_token[: start_token.index(">") + 1]
+            key = start_token[len("<s_") : -len(">")]
             key_escaped = re.escape(key)
 
             end_token = re.search(rf"</s_{key_escaped}>", tokens, re.IGNORECASE)
-            start_token = start_token.group()
             if end_token is None:
                 tokens = tokens.replace(start_token, "")
             else:

Source: Hugging Face Transformers commit ebbe9b1. The patch replaces the backtracking regex with a two-step search that locates the <s_ prefix and then uses linear string indexing to find the closing >.

Detection Methods for CVE-2025-3933

Indicators of Compromise

Sustained high CPU utilization on Python processes running the Transformers library, particularly during Donut model inference.
Inference API requests containing repeated <s_ sequences without matching closing angle brackets.
Increased request latency or timeouts on endpoints backed by DonutProcessor.

Detection Strategies

Inventory Python environments and identify installations of huggingface/transformers at version 4.50.3 or earlier using package manifests or SBOMs.
Enable application-level logging around calls to token2json() and record token payload length and processing duration.
Baseline normal CPU and request latency for Donut inference endpoints so that ReDoS-induced spikes trigger alerts.

Monitoring Recommendations

Alert when a single inference request consumes CPU time exceeding a defined threshold, such as several seconds for a single token parse.
Monitor process-level CPU saturation on ML inference workers and correlate with upstream request payload characteristics.
Track exception patterns and worker restarts in Donut serving frameworks to identify DoS attempts.

How to Mitigate CVE-2025-3933

Immediate Actions Required

Upgrade the transformers package to version 4.52.1 or later on all systems performing Donut model inference.
Audit any custom code that reuses the vulnerable token2json() logic and apply the equivalent two-step parsing pattern.
Enforce input size limits on document processing endpoints to bound worst-case regex processing time.

Patch Information

The fix is contained in commit ebbe9b12dd75b69f92100d684c47f923ee262a93 and shipped in Transformers version 4.52.1. The patch replaces the vulnerable <s_(.*?)> regex with a bounded search that locates <s_ then uses linear string slicing to find the closing >, eliminating backtracking. See the GitHub commit and the Huntr bounty report for technical details.

Workarounds

Place inference endpoints behind a request timeout and CPU quota per request to contain ReDoS impact.
Reject or truncate inputs exceeding an expected maximum token length before invocation of token2json().
Require authentication and rate limiting on Donut inference APIs to reduce exposure to unauthenticated abuse.

bash

# Upgrade Transformers to the patched release
pip install --upgrade "transformers>=4.52.1"

# Verify installed version
python -c "import transformers; print(transformers.__version__)"