PyPI: transformers
CVE-2025-6051
Safety vulnerability ID: SFTY-20250914-55651
Safety legacy ID: pyup.io-79595
Affected versions of the transformers package are vulnerable to Regular Expression Denial of Service (ReDoS) due to inefficient regular expressions in the EnglishNormalizer.normalize_numbers() method. The normalize_numbers() implementation in src/transformers/models/clvp/number_normalizer.py applies number-matching patterns such as ([0-9][0-9,]+[0-9]) to untrusted input without atomic grouping or bounds, allowing catastrophic backtracking and excessive CPU consumption.
Overview
Hugging Face Transformers library has Regular Expression Denial of Service
Advisory
Affected versions of the transformers package are vulnerable to Regular Expression Denial of Service (ReDoS) due to inefficient regular expressions in the EnglishNormalizer.normalize_numbers() method. The normalize_numbers() implementation in src/transformers/models/clvp/number_normalizer.py applies number-matching patterns such as ([0-9][0-9,]+[0-9]) to untrusted input without atomic grouping or bounds, allowing catastrophic backtracking and excessive CPU consumption.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20250914-55651/CVE-2025-6051
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6051
- https://github.com/advisories/GHSA-rcv9-qm8p-9p6j
- https://nvd.nist.gov/vuln/detail/CVE-2025-6051
- https://github.com/huggingface/transformers/commit/ba8eaba9865618253f997784aa565b96206426f0
- https://huntr.com/bounties/af929523-7b59-418a-bf55-301830b2ac9d
- https://github.com/huggingface/transformers/pull/38844
- https://github.com/huggingface/transformers/commit/54a02160eb030da9be18231c77791f2eb3a52216
- https://github.com/advisories/GHSA-rcv9-qm8p-9p6j
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more