CVE-2025-3933

CVE-2025-3933 is a Regular Expression Denial of Service (ReDoS) vulnerability found in the Hugging Face Transformers library, specifically within the DonutProcessor class's token2json() method. This flaw, present in versions 4.50.3 and earlier, stems from a vulnerable regex pattern that can be exploited with crafted input to cause catastrophic backtracking and excessive CPU consumption. The vulnerability carries a CVSS score of 5.3 (MEDIUM), indicating a low-complexity attack that can be executed remotely without user interaction, leading to service disruption and resource exhaustion. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.