Vulnerability · Published Aug 25, 2025 · Assigned by GitHub_M
CVE-2025-57809XGrammar affected by Denial of Service by infinite recursion grammars
High 7.7
In plain English
A high-severity security flaw in xgrammar from mlc-ai. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)7.7High
Exploit odds (30 days)0.5%top 58.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
XGrammar is an open-source library for efficient, flexible, and portable structured generation. Prior to version 0.1.21, XGrammar has an infinite recursion issue in the grammar. This issue has been resolved in version 0.1.21.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | xgrammar | 0.1.21 | GHSA-5cmr-4px5-23pc |
| PyPI | xgrammar | 0.1.21 | PYSEC-2026-2054 |
Affected products (as reported)
Weakness: CWE-674 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
References
- https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-5cmr-4px5-23pc x_refsource_CONFIRM
- https://github.com/mlc-ai/xgrammar/issues/250 x_refsource_MISC
- https://github.com/mlc-ai/xgrammar/commit/b943feacb5a1caf4d39de8ec3bf7c7ce066dcee5 x_refsource_MISC