CVE-2025-57809highCWE-674

CVE-2025-57809: high-severity vulnerability in mlc-ai xgrammar

XGrammar affected by Denial of Service by infinite recursion grammars

Published · Updated

Follow this CVE+ Monitor xgrammar+ Monitor xgrammar

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.7epss 0.5%
XGrammar is an open-source library for efficient, flexible, and portable structured generation. Prior to version 0.1.21, XGrammar has an infinite recursion issue in the grammar. This issue has been resolved in version 0.1.21.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
Affected products
mlc-ai · xgrammar
Related CVEs — mlc-ai xgrammar

In the same product, most dangerous first.

CVE-2026-25048HIGHxgrammar: Multi-layer nesting causes DoSEPSS 1.3%CVE-2025-58446MEDIUMxgrammar vulnerable to denial of service by huge enum grammarEPSS 0.6%CVE-2025-32381MEDIUMDenial of Service by abusing xgrammar unbounded cache in memoryEPSS 0.5%