CVE-2025-6051

What it actually does

This is a Regular Expression Denial of Service vulnerability in Hugging Face Transformers affecting versions up to 4.52.4, specifically in the EnglishNormalizer.normalize_numbers() logic used for number normalization, including text-to-speech and speech/text processing workflows. Crafted numeric strings with long digit sequences can trigger pathological regular-expression behavior, causing excessive CPU consumption and request processing delays. The impact is denial of service through resource exhaustion; it does not directly provide code execution, privilege escalation, or data access.

Why it matters to the business

Applications, APIs, batch jobs, or ML services that pass untrusted text into the affected Transformers number-normalization path can become slow or unavailable when processing maliciously crafted numeric input. This can increase infrastructure cost, degrade customer-facing speech or text features, exhaust worker pools, and cause cascading failures in dependent services. The issue is not listed in CISA KEV, is not known to be used in ransomware campaigns, has low EPSS likelihood, and has no reported mature exploit activity, but it has been public for 329 days, so exposed API surfaces should still be remediated promptly.

How an attack unfolds

An attacker first identifies an application endpoint, model pipeline, transcription workflow, text-to-speech service, or preprocessing API that uses Hugging Face Transformers EnglishNormalizer number normalization on user-supplied text. The attacker submits input containing intentionally long digit sequences or numeric patterns designed to exercise the vulnerable regular expression path. When the vulnerable normalize_numbers() method processes the input, CPU time spikes disproportionately compared with input size. Repeated requests can keep application workers busy, cause timeouts, starve queues, trigger autoscaling, or render the service unavailable. Because this is a ReDoS flaw, exploitation generally requires only the ability to submit text for processing; it does not require authentication if the vulnerable feature is exposed anonymously, and successful exploitation is observed as latency, CPU saturation, failed requests, or service restarts rather than shell access or malware execution.

How to fix it

Upgrade Hugging Face Transformers to version 4.53.0 or later. For source-based deployments, use a version containing commit ba8eaba9865618253f997784aa565b96206426f0 or later. Rebuild and redeploy containers, serverless packages, notebooks, ML images, and batch-processing environments that vendor or pin Transformers. Review dependency lockfiles because indirect dependencies may keep the vulnerable version installed. The provided affected-products metadata also lists Debian pidgin package fixes at 2.7.0-1, but that package does not align with the described Hugging Face Transformers ReDoS issue; validate package advisories from the relevant distribution before treating those package entries as authoritative for this flaw. As mitigations where immediate upgrade is not possible, impose strict maximum input lengths for text and digit runs, reject or truncate unusually long numeric tokens, add per-request CPU/time limits, apply rate limiting, isolate ML preprocessing workers, and use queue backpressure so one expensive request cannot exhaust the service.

How to confirm the fix worked

Confirm the installed Transformers version is 4.53.0 or later using package inventory, lockfiles, container SBOMs, or commands such as pip show transformers or python -c "import transformers; print(transformers.__version__)". Confirm deployed artifacts were rebuilt after the dependency change, not only source repositories updated. Search code for use of EnglishNormalizer, normalize_numbers(), Whisper normalization, text-to-speech preprocessing, or number normalization on untrusted input. In a controlled non-production environment, run bounded performance tests with long numeric inputs and verify processing time remains capped and does not cause worker starvation. Validate that API gateways, application code, and background queues enforce maximum body size, maximum text length, maximum numeric-token length, timeouts, and rate limits. Review runtime metrics after deployment to ensure CPU spikes and timeout rates return to baseline.

Typical attack path

1. Find a public or internal endpoint that accepts user-controlled text for speech, transcription, text-to-speech, captioning, normalization, or model preprocessing.
2. Confirm that the service uses an affected Hugging Face Transformers version and invokes EnglishNormalizer.normalize_numbers() or an equivalent affected normalization path.
3. Send crafted text containing very long numeric strings or numeric formatting patterns.
4. Observe elevated response time, request timeout, or worker CPU saturation.
5. Repeat or parallelize requests to exhaust application workers, queues, CPU capacity, or autoscaling limits.
6. Maintain service disruption until requests are blocked, rate-limited, or the vulnerable package is upgraded.

How to detect it

Because this vulnerability causes denial of service rather than persistent compromise, evidence of exploitation is most likely in application, API gateway, load balancer, APM, container, and host telemetry. Review logs for requests with unusually long contiguous digit sequences, especially around periods of CPU saturation, worker timeouts, queue growth, HTTP 408/429/499/500/502/503/504 responses, or application restarts. Correlate spikes in CPU usage with endpoints that perform transcription, speech processing, text-to-speech, captioning, normalization, or ML inference. Search application error logs and stack traces for EnglishNormalizer, normalize_numbers, and transformers.models.whisper.english_normalizer. Examine access logs for repeated requests from the same IP, user agent, API token, or autonomous system containing very large request bodies or numeric-heavy payloads. In Kubernetes or container environments, review pod restart events, OOM/CPU throttling metrics, liveness probe failures, and worker timeout messages. Network payload retention, WAF logs, API gateway request sampling, and APM spans are the most useful sources because the malicious artifact is the input string itself.

• EnglishNormalizer
• normalize_numbers
• transformers.models.whisper.english_normalizer
• transformers/models/whisper/english_normalizer.py
• [0-9]{1000,}
• TimeoutError
• ReadTimeout
• 504 Gateway Timeout
• 503 Service Unavailable
• worker timeout
• CPU throttling
• liveness probe failed

What your security team should do

• Inventory all applications, containers, notebooks, ML services, and batch jobs using Hugging Face Transformers versions up to 4.52.4.
• Prioritize upgrades for internet-facing APIs, unauthenticated text-processing endpoints, transcription services, text-to-speech services, and high-volume ML inference platforms.
• Upgrade Transformers to 4.53.0 or later and rebuild all runtime images and dependency lockfiles.
• Add input validation that limits total text size and rejects unusually long contiguous digit sequences before normalization.
• Apply request timeouts, worker execution limits, rate limits, queue backpressure, and autoscaling safeguards for ML preprocessing services.
• Monitor for anomalous CPU saturation, increased request latency, timeout spikes, and repeated requests containing very long digit sequences.
• If the affected package is embedded in third-party products or appliances, request vendor confirmation of the bundled Transformers version and patch status.
• Treat this as a service-availability risk rather than a data-theft or remote-code-execution event unless separate indicators suggest broader compromise.