Skip to content
OpenAdvisories
Medium · 6.9 CVE-2025-58446 EUVD-2025-27083GHSA-9q5r-wfvf-rr7fPYSEC-2026-2055

xgrammar vulnerable to denial of service by huge enum grammar

Published Sep 6, 2025 · Updated Sep 8, 2025 · Assigned by GitHub_M

Description

xgrammar is an open-source library for efficient, flexible, and portable structured generation. A grammar optimizer introduced in 0.1.23 processes large grammars (>100k characters) at very low rates, and can be used for DOS of model providers. This issue is fixed in version 0.1.24.

Affected products

VendorProductAffectedFixed
mlc-ai xgrammar = 0.1.23, < 0.1.24 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI xgrammar >= 0.1.23, < 0.1.24 0.1.24 GHSA-9q5r-wfvf-rr7f

References