CVE-2025-6051

[CVE catalog]

Severity

Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Published

Sep 14, 2025, 5:03:02 PM UTC

Updated

Jul 7, 2026, 5:56:51 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.38% · Oct 25, 2026

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library’s EnglishNormalizer.normalize_numbers method of the CLVP model. Maliciously crafted long numeric strings cause excessive CPU usage due to inefficient regex processing, leading to potential service disruption. transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers This ReDoS vulnerability is classified as a Moderate issue because, while it does not compromise confidentiality or integrity, it can significantly impact the availability of services using the affected component. Attackers can exploit this flaw by sending specially crafted long numeric inputs that cause excessive CPU consumption, potentially slowing down or crashing text processing pipelines, such as text-to-speech systems. Although it requires no special privileges or user interaction, the impact is limited to resource exhaustion rather than data theft or system takeover. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.