Denial of Service Vulnerability in xgrammar Library from mlc-ai
CVE-2025-58446

6.9MEDIUM

Key Information:

Vendor

Mlc-ai

Status
Xgrammar
Vendor
CVE Published:
6 September 2025

What is CVE-2025-58446?

The xgrammar library, an open-source tool for structured generation, contains a vulnerability in version 0.1.23 that can cause Denial of Service (DoS) for model providers by processing large grammars (over 100k characters) at significantly low rates. This flaw can lead to performance degradation and unresponsive services. The issue has been resolved in version 0.1.24, which is recommended for all users to ensure optimal functionality and security.

Affected Version(s)

xgrammar = 0.1.23, < 0.1.24

References

https://github.com/mlc-ai/xgrammar/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/mlc-ai/xgrammar/commit/ced69c3ad2f8f61...
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-58446 : Denial of Service Vulnerability in xgrammar Library from mlc-ai