CVE-2025-6638: 
NixOS vulnerability analysis and mitigation

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's remove_language_code() method. The vulnerability is present in version 4.52.4 and has been fixed in version 4.53.0 (NVD).

The vulnerability arises from inefficient regex processing in the MarianTokenizer component. The issue specifically occurs in the remove_language_code() method where a regular expression pattern is used to process language code patterns. The vulnerability has been assigned a CVSS v3.0 base score of 5.3 (Medium) with the vector string CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. The weakness has been classified as CWE-1333 (Inefficient Regular Expression Complexity) (NVD, Huntr).

When exploited, the vulnerability can lead to excessive CPU consumption and potential denial of service through crafted input strings containing malformed language code patterns (NVD).

The vulnerability has been fixed in version 4.53.0 of the Hugging Face Transformers library. The fix involves removing the use of regular expressions entirely and implementing a simpler string-based approach for language code processing (GitHub Commit).