GitHub Advisoryadvisory · PyPI

GHSA-rcv9-qm8p-9p6j Hugging Face Transformers library has Regular Expression Denial of Service

MEDIUM Published 2025-09-14 Modified 2025-09-15 Official page ↗
Aliases
CVE-2025-6051
Ecosystem
PyPI
Packages
transformers
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-1333
Reviewed
2025-09-15

Affected packages

• PyPI transformers: < 4.53.0 → fixed in 4.53.0

Description

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the `normalize_numbers()` method of the `EnglishNormalizer` class. This vulnerability affects versions up to 4.52.4 and is fixed in version 4.53.0. The issue arises from the method's handling of numeric strings, which can be exploited using crafted input strings containing long sequences of digits, leading to excessive CPU consumption. This vulnerability impacts text-to-speech and number normalization tasks, potentially causing service disruption, resource exhaustion, and API vulnerabilities.

Related

Alias · CVE (1)

  • CVE-2025-6051 A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within… vulnerability

Weakness · CWE (1)

  • CWE-1333 Inefficient Regular Expression Complexity weakness

References