CVE-2025-32381

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-32381
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32381.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-32381
Aliases
Related
Published
2025-04-09T16:00:10.642Z
Modified
2026-04-10T05:25:53.967224Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Denial of Service by abusing xgrammar unbounded cache in memory
Details

XGrammar is an open-source library for efficient, flexible, and portable structured generation. Prior to 0.1.18, Xgrammar includes a cache for compiled grammars to increase performance with repeated use of the same grammar. This cache is held in memory. Since the cache is unbounded, a system making use of xgrammar can be abused to fill up a host's memory and case a denial of service. For example, sending many small requests to an LLM inference server with unique JSON schemas would eventually cause this denial of service to occur. This vulnerability is fixed in 0.1.18.

Database specific 
{
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32381.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/mlc-ai/xgrammar

Affected ranges

Type
GIT
Repo
https://github.com/mlc-ai/xgrammar
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8062becde6678f9944f4c0c1f0f88c638dcfb566

Affected versions

v0.*
v0.1.10
v0.1.11
v0.1.12
v0.1.13
v0.1.14
v0.1.15
v0.1.16
v0.1.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32381.json"