Infinite Recursion Vulnerability in XGrammar Library by MLC AI
CVE-2025-57809

7.7HIGH

Key Information:

Vendor

Mlc-ai

Status
Xgrammar
Vendor
CVE Published:
25 August 2025

What is CVE-2025-57809?

The XGrammar library, developed by MLC AI, is designed for efficient and flexible structured generation. However, versions prior to 0.1.21 exhibit a serious vulnerability characterized by infinite recursion in the grammar generation process. This flaw can lead to excessive memory consumption, potentially causing applications that utilize this library to crash or behave unpredictably. Users are strongly advised to upgrade to version 0.1.21 or later to mitigate this issue and enhance the stability and security of their applications.

Affected Version(s)

xgrammar < 0.1.21

References

https://github.com/mlc-ai/xgrammar/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/mlc-ai/xgrammar/issues/250
x_refsource_MISC
https://github.com/mlc-ai/xgrammar/commit/b943feacb5a1caf...
x_refsource_MISC

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-57809 : Infinite Recursion Vulnerability in XGrammar Library by MLC AI