{"data":{"id":"aa5469cb-f8e5-42bc-8177-4675337f44e3","title":"CVE-2025-6051: A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library…","summary":"CVE-2025-6051 is a Regular Expression Denial of Service (ReDoS) flaw in the `normalize_numbers()` method of the `EnglishNormalizer` class in the Hugging Face Transformers library, affecting versions up to 4.52.4. Crafted input strings containing long sequences of digits cause excessive CPU consumption, which impacts text-to-speech and number normalization tasks and can lead to service disruption and resource exhaustion.","solution":"Fixed in 4.53.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-6051","publishedAt":"2025-09-14T21:15:34.210Z","cveId":"CVE-2025-6051","cweIds":["CWE-1333"],"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["transformers@< 4.53.0 (fixed: 4.53.0)"],"affectedPackageNames":["transformers"],"affectedPackageRefs":["pypi:transformers"],"affectedVendors":["HuggingFace"],"affectedVendorsRaw":["Hugging Face Transformers","EnglishNormalizer"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Hugging Face Transformers ReDoS in EnglishNormalizer normalize_numbers method","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00382,"epssCheckedAt":"2026-11-04T12:08:35.127Z","kevDateAdded":null,"advisoryAliases":["GHSA-rcv9-qm8p-9p6j"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:52:44.953Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-06-26T16:10:51.505Z","daysToFix":-80,"fixCheckedAt":"2026-10-29T21:43:46.681Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"transformers","fixedVersion":"4.53.0","matchedVersion":"4.53.0","fixReleasedAt":"2025-06-26T16:10:51.505Z","daysToFix":-80,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:43:46.531Z"}]}}