CVE-2025-6051: Huggingface Transformers DoS Vulnerability

CVE-2025-6051 Overview

CVE-2025-6051 is a Regular Expression Denial of Service (ReDoS) vulnerability in the Hugging Face Transformers library. The flaw resides in the normalize_numbers() method of the EnglishNormalizer class within the CLVP (Contrastive Language-Voice Pretraining) model's number normalizer. Attackers can craft input strings with long sequences of digits to trigger catastrophic backtracking in the regex engine, causing excessive CPU consumption. The vulnerability affects Transformers versions up to and including 4.52.4 and is fixed in version 4.53.0. Impact centers on text-to-speech and number normalization pipelines, where service disruption and resource exhaustion can degrade or halt inference APIs.

Critical Impact
Remote unauthenticated attackers can send crafted numeric input to Transformers-based services and exhaust CPU resources, disrupting text-to-speech and number normalization workloads.

Affected Products

Hugging Face Transformers versions up to and including 4.52.4
CLVP model's EnglishNormalizer class in src/transformers/models/clvp/number_normalizer.py
Downstream applications and APIs invoking text-to-speech or number normalization pipelines

Discovery Timeline

2025-09-14 - CVE-2025-6051 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6051

Vulnerability Analysis

The vulnerability is an Inefficient Regular Expression Complexity issue [CWE-1333]. The normalize_numbers() method in the EnglishNormalizer class relies on regex patterns that exhibit catastrophic backtracking when processing long digit sequences. When the regex engine attempts to match a crafted numeric string, it explores an exponential number of match paths before failing or completing.

Processing time grows non-linearly with input length. A modest-size payload containing repeated digits can occupy a worker thread for seconds or minutes. In inference services that expose text normalization over HTTP, an attacker can send successive crafted requests to saturate CPU and starve legitimate traffic. Availability is the primary impact; confidentiality and integrity are not affected.

Root Cause

The root cause is the use of the third-party regex module without atomic grouping protection in versions of Python prior to 3.11. The vulnerable pattern in number_normalizer.py matches numeric substrings with quantifiers that permit ambiguous partitions of the input. Long digit runs cause the engine to attempt every possible split before returning a result, producing worst-case exponential runtime.

Attack Vector

Exploitation requires no authentication and no user interaction. Any endpoint that forwards user-supplied text into the CLVP EnglishNormalizer pipeline is reachable over the network. An attacker submits input containing a long uninterrupted sequence of digits and observes prolonged response times or worker exhaustion.

python

# Security patch: src/transformers/models/clvp/number_normalizer.py
"""English Normalizer class for CLVP."""

-import regex as re
+import sys
+
+
+if sys.version_info >= (3, 11):
+    # Atomic grouping support was only added to the core RE in Python 3.11
+    import re
+else:
+    import regex as re


class EnglishNormalizer:
    ...

The patch switches to the standard-library re module on Python 3.11 or later, which supports atomic grouping used to prevent backtracking. Source: Hugging Face Transformers commit ba8eaba.

Detection Methods for CVE-2025-6051

Indicators of Compromise

Sustained high CPU utilization on Python worker processes running Transformers text-to-speech or normalization pipelines
Inbound HTTP requests containing unusually long uninterrupted digit sequences submitted to normalization or TTS endpoints
Request timeouts, worker restarts, or 5xx errors correlated with specific client IP addresses

Detection Strategies

Instrument the normalize_numbers() code path with per-request timing metrics and alert on outliers exceeding a defined threshold
Inspect application logs for requests where processing time exceeds the 99th percentile of baseline normalization latency
Deploy Web Application Firewall (WAF) rules that flag or block payloads containing digit runs longer than an expected business maximum

Monitoring Recommendations

Track CPU utilization per inference worker and alert on prolonged saturation from single client sources
Log the length distribution of input strings submitted to text normalization endpoints and review anomalies
Enable rate limiting per source IP and monitor for burst patterns targeting TTS or normalization APIs

How to Mitigate CVE-2025-6051

Immediate Actions Required

Upgrade Hugging Face Transformers to version 4.53.0 or later in all environments running the CLVP model or EnglishNormalizer
Inventory Python services that import transformers.models.clvp and prioritize patching public-facing endpoints
Apply input length limits at the API gateway to reject requests exceeding a reasonable text payload size

Patch Information

The fix is committed in the Hugging Face Transformers repository and released in version 4.53.0. The patch imports Python's standard-library re module on Python 3.11 or later where atomic grouping is supported, eliminating the catastrophic backtracking behavior. Review the upstream commit ba8eaba and the Huntr Bug Bounty Report for full details.

Workarounds

Enforce strict maximum input length on any text passed to normalize_numbers() at the application layer
Reject or sanitize inputs containing digit sequences longer than the longest legitimate business value
Wrap normalization calls in a per-request timeout and terminate workers that exceed the budget
Run inference workers behind a supervisor that automatically restarts processes exceeding CPU limits

bash

# Upgrade to the patched version
pip install --upgrade 'transformers>=4.53.0'

# Verify installed version
python -c "import transformers; print(transformers.__version__)"