CVE-2025-6051

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the `normalize_numbers()` method of the `EnglishNormalizer` class. This vulnerability affects versions up to 4.52.4 and is fixed in version 4.53.0. The issue arises from the method's handling of numeric strings, which can be exploited using crafted input strings containing long sequences of digits, leading to excessive CPU consumption. This vulnerability impacts text-to-speech and number normalization tasks, potentially causing service disruption, resource exhaustion, and API vulnerabilities.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/huggingface/transformers/commit/ba8eaba9865618253f997784aa565b96206426f0	Patch
https://huntr.com/bounties/af929523-7b59-418a-bf55-301830b2ac9d	Exploit Issue Tracking Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:huggingface:transformers:4.52.4:*:*:*:*:*:*:*

History

30 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Se descubrió una vulnerabilidad de denegación de servicio por expresión regular (ReDoS) en la biblioteca Hugging Face Transformers, específicamente dentro del método 'normalize_numbers()' de la clase 'EnglishNormalizer'. Esta vulnerabilidad afecta a las versiones hasta la 4.52.4 y está corregida en la versión 4.53.0. El problema surge del manejo de cadenas numéricas por parte del método, que puede ser explotado utilizando cadenas de entrada manipuladas que contengan largas secuencias de dígitos, lo que lleva a un consumo excesivo de CPU. Esta vulnerabilidad impacta en las tareas de texto a voz y normalización de números, potencialmente causando interrupción del servicio, agotamiento de recursos y vulnerabilidades de API.

Information

Published : 2025-09-14 17:15

Updated : 2026-09-30 23:10

NVD link : CVE-2025-6051

Mitre link : CVE-2025-6051

CVE.ORG link : CVE-2025-6051

JSON object : View

Products Affected

huggingface

transformers

CWE

CWE-1333

Inefficient Regular Expression Complexity

{"id": "CVE-2025-6051", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-6051", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-15T15:59:46.280744Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@huntr.dev", "affectedData": [{"vendor": "huggingface", "product": "huggingface/transformers", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "4.53.0", "versionType": "custom"}]}]}], "published": "2025-09-14T17:15:34.210", "references": [{"url": "https://github.com/huggingface/transformers/commit/ba8eaba9865618253f997784aa565b96206426f0", "tags": ["Patch"], "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/af929523-7b59-418a-bf55-301830b2ac9d", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "source": "security@huntr.dev"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-1333"}]}], "descriptions": [{"lang": "en", "value": "A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the `normalize_numbers()` method of the `EnglishNormalizer` class. This vulnerability affects versions up to 4.52.4 and is fixed in version 4.53.0. The issue arises from the method's handling of numeric strings, which can be exploited using crafted input strings containing long sequences of digits, leading to excessive CPU consumption. This vulnerability impacts text-to-speech and number normalization tasks, potentially causing service disruption, resource exhaustion, and API vulnerabilities."}, {"lang": "es", "value": "Se descubri\u00f3 una vulnerabilidad de denegaci\u00f3n de servicio por expresi\u00f3n regular (ReDoS) en la biblioteca Hugging Face Transformers, espec\u00edficamente dentro del m\u00e9todo 'normalize_numbers()' de la clase 'EnglishNormalizer'. Esta vulnerabilidad afecta a las versiones hasta la 4.52.4 y est\u00e1 corregida en la versi\u00f3n 4.53.0. El problema surge del manejo de cadenas num\u00e9ricas por parte del m\u00e9todo, que puede ser explotado utilizando cadenas de entrada manipuladas que contengan largas secuencias de d\u00edgitos, lo que lleva a un consumo excesivo de CPU. Esta vulnerabilidad impacta en las tareas de texto a voz y normalizaci\u00f3n de n\u00fameros, potencialmente causando interrupci\u00f3n del servicio, agotamiento de recursos y vulnerabilidades de API."}], "lastModified": "2026-09-30T23:10:00.237", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:huggingface:transformers:4.52.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BA362206-8A09-4249-A522-427C8793D241"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}