5.3
Moyenne
CVE-2025-6051 A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library,…
Description
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the `normalize_numbers()` method of the `EnglishNormalizer` class. This vulnerability affects versions up to 4.52.4 and is fixed in version 4.53.0. The issue arises from the method's handling of numeric strings, which can be exploited using crafted input strings containing long sequences of digits, leading to excessive CPU consumption. This vulnerability impacts text-to-speech and number normalization tasks, potentially causing service disruption, resource exhaustion, and API vulnerabilities.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| huggingface/transformers 4.53 | premières → < 4.53.0 | 4.53.0 |
Autres CVE de huggingface/transformers
Les 20 CVE de huggingface/transformers →
CVE-2026-9856
A vulnerability in huggingface/transformers…
7.1
Élevée
CVE-2026-5241
A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an…
8.0
Élevée
CVE-2026-4372
A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to…
7.8
Élevée
CVE-2026-1839
A vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary…
6.5
Moyenne