CVE-2025-3933

What it actually does

This is a Regular Expression Denial of Service vulnerability in Hugging Face Transformers versions 4.51.3 and earlier, affecting the DonutProcessor class and its token2json() method. The vulnerable parsing logic uses the pattern `<s_(.*?)>` against model output or supplied token text; specially crafted strings can trigger catastrophic backtracking, causing the Python process to consume excessive CPU while attempting to evaluate the regex. The impact is denial of service rather than code execution: affected document-processing workflows can become slow, hang worker threads or processes, exhaust compute capacity, and degrade API availability.

Why it matters to the business

Organizations using vulnerable Transformers versions for Donut-based document understanding, OCR-like extraction, receipt/invoice parsing, or API-backed document processing could experience service slowdowns or outages if malformed input reaches the vulnerable parser. Because the issue can waste CPU, it may also increase cloud or GPU-adjacent processing costs, create queue backlogs, delay business workflows, and reduce reliability of AI-enabled document automation. The current EPSS is low and the issue is not in CISA KEV, with no known mature public exploitation indicated, but exposed document-processing endpoints should still be prioritized because denial-of-service flaws are easy to trigger once a vulnerable code path is reachable.

How an attack unfolds

An attacker first identifies an application or API that accepts documents, text, or model output that is processed with Hugging Face Transformers DonutProcessor on a vulnerable version. They then submit crafted content designed to influence the token stream passed into token2json(), especially strings containing repeated or malformed Donut-style start-token patterns such as `<s_` without clean matching delimiters. When the application invokes token2json(), the vulnerable regex attempts many backtracking combinations while searching for matches. This pins CPU in the Python worker handling the request, delaying or preventing normal processing. Repeated requests can tie up multiple workers, fill job queues, trigger autoscaling, exhaust compute budgets, and cause document-processing APIs or background pipelines to become unavailable. The attacker does not need to execute code or authenticate if the vulnerable workflow is reachable through an unauthenticated document-processing endpoint, although access requirements depend on the application exposing the library.

How to fix it

Upgrade Hugging Face Transformers to version 4.52.1 or later. For source-based deployments, ensure the fix commit 945727948c1143a10ac6f7d811aa58bb0d126b5b or a later commit is present. Rebuild and redeploy all application images, model-serving containers, serverless packages, notebooks promoted to production, and batch-processing workers that vendor or pin the transformers package. If immediate upgrade is not possible, reduce exposure by enforcing strict request size limits, maximum token length limits, document page limits, per-request CPU or wall-clock timeouts, worker isolation, queue throttling, and rate limits on document-processing endpoints. Avoid passing untrusted raw text directly into DonutProcessor.token2json() where possible, and add validation that rejects unusually long or repetitive `<s_` marker sequences before parsing.

How to confirm the fix worked

Confirm that all runtime environments report Hugging Face Transformers version 4.52.1 or later, or that source builds include commit 945727948c1143a10ac6f7d811aa58bb0d126b5b. Validate using dependency manifests, container image software bills of materials, `pip show transformers`, `python -c "import transformers; print(transformers.__version__)"`, and source inspection for the patched DonutProcessor implementation. Exercise the Donut document-processing workflow with normal inputs and with intentionally malformed long token strings in a controlled test environment; patched deployments should reject, limit, or process such inputs without sustained CPU spikes or worker hangs. Also confirm operational controls such as request-size limits, timeouts, and rate limits are active at the API gateway, job queue, and worker layers.

Typical attack path

1. Locate an application, API, or batch-processing workflow that uses Hugging Face Transformers DonutProcessor for document or structured text extraction.
2. Determine that the service accepts attacker-controlled documents, images, OCR output, generated text, or token strings that can reach DonutProcessor.token2json().
3. Send input containing malformed or repetitive Donut-style token markers designed to stress the `<s_(.*?)>` regex.
4. Trigger the vulnerable token2json() parsing path during model post-processing.
5. Cause excessive CPU consumption in the Python worker or inference service handling the request.
6. Repeat or parallelize requests to exhaust worker capacity, increase latency, fill queues, or disrupt the document-processing service.

How to detect it

To determine whether exploitation has already occurred, review application logs, API gateway logs, job queue telemetry, model-serving logs, container metrics, and host/process monitoring for document-processing services using Donut or Hugging Face Transformers. Look for clusters of requests with unusually long processing times, HTTP 408/429/499/500/502/503/504 responses, worker timeouts, queue backlogs, autoscaling events, or Python processes pinned at high CPU without corresponding throughput. Inspect request metadata and safely retained payload excerpts for repeated or malformed Donut token markers, especially excessive `<s_` substrings or inputs that appear to omit normal closing `>` delimiters. Review Python stack traces, profiling samples, or watchdog dumps for execution inside `DonutProcessor.token2json`, `processing_donut.py`, or regex evaluation paths. Because this vulnerability does not create a unique file, process, registry key, or network callback, detection should focus on behavioral denial-of-service indicators combined with evidence that suspicious inputs reached the vulnerable Donut parsing path.

• DonutProcessor.token2json
• transformers.models.donut.processing_donut
• processing_donut.py
• <s_(.*?)>
• <s_
• Regex timed out
• regular expression
• catastrophic backtracking
• CPU time limit exceeded
• worker timeout
• request timeout
• ReadTimeout
• 504 Gateway Timeout
• 503 Service Unavailable
• 429 Too Many Requests
• python -c "import transformers; print(transformers.__version__)"
• transformers==4.51.3
• transformers==4.51.2
• transformers==4.51.1
• transformers==4.51.0

What your security team should do

• Inventory services, containers, batch jobs, notebooks, and model-serving endpoints that include Hugging Face Transformers and use DonutProcessor or Donut models.
• Upgrade affected deployments from Transformers 4.51.3 or earlier to 4.52.1 or later, or verify inclusion of commit 945727948c1143a10ac6f7d811aa58bb0d126b5b.
• Prioritize internet-facing or partner-facing document-processing APIs, especially those accepting unauthenticated or high-volume uploads.
• Add or verify request body limits, document size limits, token length limits, CPU timeouts, worker execution timeouts, queue backpressure, and per-client rate limits.
• Search logs and telemetry for unexplained CPU saturation, long request durations, worker timeouts, and repeated malformed Donut token markers around document-processing endpoints.
• Create detection logic for excessive occurrences of `<s_` in submitted text, OCR output, serialized model output, or application error logs.
• Ensure dependency scanning policies flag Transformers versions 4.51.3 and earlier as vulnerable and prevent new deployments with those versions.
• After patching, monitor latency, queue depth, worker restarts, and CPU utilization to confirm denial-of-service symptoms have not persisted.