PT-2025-37422 · Hugging Face · Huggingface/Transformers

Published 2025-06-09 · Updated 2025-10-21 · CVE-2025-6051

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Hugging Face Transformers versions up to 4.52.4

Description A Regular Expression Denial of Service (ReDoS) vulnerability exists in the normalize numbers() method of the EnglishNormalizer class. This issue arises from the method's handling of numeric strings, which can be exploited using crafted input strings containing long sequences of digits, leading to excessive CPU consumption. This impacts text-to-speech and number normalization tasks, potentially causing service disruption and resource exhaustion.

Recommendations Update to version 4.53.0 or later.

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

BDU:2025-12549

CVE-2025-6051

GHSA-RCV9-QM8P-9P6J

Affected Products

Huggingface/Transformers

References · 15

• https://github.com/huggingface/transformers/commit/ba8eaba9865618253f997784aa565b96206426f0 · Patch
• https://bdu.fstec.ru/vul/2025-12549 · Security Note
• https://osv.dev/vulnerability/CVE-2025-6051 · Vendor Advisory
• https://huntr.com/bounties/af929523-7b59-418a-bf55-301830b2ac9d · Patch
• https://osv.dev/vulnerability/GHSA-rcv9-qm8p-9p6j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6051 · Security Note
• https://github.com/huggingface/transformers · Note
• https://github.com/huggingface/transformers/commit/54a02160eb030da9be18231c77791f2eb3a52216 · Note
• https://github.com/huggingface/transformers/pull/38844 · Note
• https://t.me/cveNotify/135408 · Telegram Post
• https://t.me/cveNotify/139594 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1967279532290740433 · Twitter Post
• https://twitter.com/CVEnew/status/1967278976696492255 · Twitter Post
• https://twitter.com/BaseFortify/status/1967496295578513711 · Twitter Post
• https://t.me/CVEtracker/32456 · Telegram Post