CVE-2025-6051 Regular Expression Denial of Service (ReDoS) in huggingface/transformers

A Regular Expression Denial of Service ReDoS vulnerability was discovered in the Hugging Face Transformers library, specifically within the normalizenumbers method of the EnglishNormalizer class. This vulnerability affects versions up to 4.52.4 and is fixed in version 4.53.0. The issue arises fro...

CVE-2025-6051 Regular Expression Denial of Service (ReDoS) in huggingface/transformers

A Regular Expression Denial of Service ReDoS vulnerability was discovered in the Hugging Face Transformers library, specifically within the normalizenumbers method of the EnglishNormalizer class. This vulnerability affects versions up to 4.52.4 and is fixed in version 4.53.0. The issue arises fro...

Hugging Face Transformers 安全漏洞

Hugging Face Transformers is Hugging Face's open source advanced natural language processing for Jax, PyTorch and TensorFlow. A security vulnerability exists in Hugging Face Transformers version 4.52.4 and earlier, which stems from the mishandling of numeric strings in the normalizenumbers method...

CVE-2025-6638 Regular Expression Denial of Service (ReDoS) in huggingface/transformers

A Regular Expression Denial of Service ReDoS vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's removelanguagecode method. This vulnerability is present in version 4.52.4 and has been fixed in version 4.53.0. The issue arises from...

Regular Expression Denial of Service (ReDoS)

Overview transformers is a State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the removelanguagecode function in the MarianTokenizer class, when handling malformed language code...

CVE-2025-6638

CVE-2025-6638 affects Hugging Face Transformers, specifically MarianTokenizer.remove_language_code(). The vulnerability arises from inefficient regex processing that can be triggered by crafted input patterns, causing high CPU usage and potential DoS. Affected version: 4.52.4; fixed in 4.53.0. IB...

CVE-2025-6638 Regular Expression Denial of Service (ReDoS) in huggingface/transformers

A Regular Expression Denial of Service ReDoS vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's removelanguagecode method. This vulnerability is present in version 4.52.4 and has been fixed in version 4.53.0. The issue arises from...

PT-2025-37307

Name of the Vulnerable Software and Affected Versions: Hugging Face Transformers versions prior to 4.53.0 Description: A Regular Expression Denial of Service ReDoS vulnerability exists in the Hugging Face Transformers library, specifically affecting the remove language code method within the...

Erlang/OTP (Erlang OTP) Buffer Read Overflow Vulnerability (Sep 2025) - Windows

Erlang/OTP Erlang OTP is prone to a buffer read overflow vulnerability in the erts component. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only C...

Linux Distros Unpatched Vulnerability : CVE-2021-41959

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JerryScript Git version 14ff5bf does not sufficiently track and release allocated memory via jerry- core/ecma/operations/ecma-regexp-object.c after RegExp, whic...

Regular Expression Denial of Service (ReDoS)

Overview cattown is an A lightweight, pure JavaScript markdown parser with built-in HTML sanitization using DOMPurify. Converts markdown to clean, safe HTML with customizable styling. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via inefficient...

Permissive Regular Expression

Overview @mathharo/promptcraft-sanitize is a Sanitizer fix for overlapping multi-token patterns. Affected versions of this package are vulnerable to Permissive Regular Expression due to insufficient replacement of multi-character tokens. An attacker can execute arbitrary scripts in the context of...

rexml: REXML ReDoS vulnerability

A flaw was found in the ReXML XML toolkit for Ruby. Parsing XML data containing a large number of digits between & and x...; in a hex numeric character reference &x...; can trigger a regular expression denial of service ReDoS condition, leading to a denial of service...

Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.

...

Promptcraft Forge Studio 安全漏洞

Promptcraft Forge Studio is a developer toolkit for Marcelo Tessaro Individual Developer. A security vulnerability exists in Promptcraft Forge Studio that stems from improperly cleaning up user input using a regular expression blacklist, which could lead to the execution of a malicious payload...

A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.

...

Linux Distros Unpatched Vulnerability : CVE-2021-3765

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - validator.js is vulnerable to Inefficient Regular Expression Complexity CVE-2021-3765 Note that Nessus relies on the presence of the package as reported by the...

Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to transformers-4.48.0-py3-none-any.whl CVE-2025-2099

Summary IBM Maximo Application Suite - Monitor Component is vulnerable to transformers-4.48.0-py3-none-any.whl CVE-2025-2099. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2025-2099 DESCRIPTION: A vulnerability in the preprocessstring...

Linux Distros Unpatched Vulnerability : CVE-2025-54364

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Microsoft Knack 0.12.0 allows Regular expression Denial of Service ReDoS in the knack.introspection module. optiondescriptions employs an inefficient regular...

Linux Distros Unpatched Vulnerability : CVE-2018-7158

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The 'path' module in the Node.js 4.x release line contains a potential regular expression denial of service ReDoS vector. The code in question was replaced in...