CVE-2025-6051: Regular Expression Denial of Service (ReDoS) in huggingface/transformers
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the normalizenumbers() method of the EnglishNormalizer class. This vulnerability affects versions up to 4.52.4 and is fixed in version 4.53.0. The issue arises from the method's handling of numeric strings, which can be exploited using crafted input strings containing long sequences of digits, leading to excessive CPU consumption. This vulnerability impacts text-to-speech and number normalization tasks, potentially causing service disruption, resource exhaustion, and API vulnerabilities.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6051?
CVE-2025-6051 has a severity rating that indicates a Regular Expression Denial of Service (ReDoS) vulnerability affecting specific methods in the Hugging Face Transformers library.
How do I fix CVE-2025-6051?
To fix CVE-2025-6051, upgrade the Hugging Face Transformers library to version 4.53.0 or later.
Which versions are affected by CVE-2025-6051?
CVE-2025-6051 affects versions of Hugging Face Transformers up to and including 4.52.4.
What type of vulnerability is CVE-2025-6051?
CVE-2025-6051 is classified as a Regular Expression Denial of Service (ReDoS) vulnerability.
What function in the Hugging Face Transformers library is vulnerable in CVE-2025-6051?
The vulnerable function in CVE-2025-6051 is the `normalize_numbers()` method of the `EnglishNormalizer` class.