CVE-2025-57809

XGrammar affected by Denial of Service by infinite recursion grammars

CVSS 7.7 HIGHEPSS 0.4%CWE-674

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.7EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

25 Aug 2025Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

XGrammar is an open-source library for efficient, flexible, and portable structured generation. Prior to version 0.1.21, XGrammar has an infinite recursion issue in the grammar. This issue has been resolved in version 0.1.21.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

Affected products

mlc-ai · xgrammar

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/mlc-ai/xgrammar/commit/b943feacb5a1caf4d39de8ec3bf7c7ce066dcee5 https://github.com/mlc-ai/xgrammar/issues/250 https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-5cmr-4px5-23pc