6.5

CVE-2025-32381

Denial of Service by abusing xgrammar unbounded cache in memory

XGrammar is an open-source library for efficient, flexible, and portable structured generation. Prior to 0.1.18, Xgrammar includes a cache for compiled grammars to increase performance with repeated use of the same grammar. This cache is held in memory. Since the cache is unbounded, a system making use of xgrammar can be abused to fill up a host's memory and case a denial of service. For example, sending many small requests to an LLM inference server with unique JSON schemas would eventually cause this denial of service to occur. This vulnerability is fixed in 0.1.18.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mlc-ai ≫ Xgrammar Version < 0.1.18
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.41% 0.325
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-770 Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

https://github.com/mlc-ai/xgrammar/pull/243
Patch
Issue Tracking
https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-389x-67px-mjg3
Vendor Advisory
https://github.com/vllm-project/vllm/pull/16283
Patch
Issue Tracking