What’s Vulnerable › Vulnerabilities

CVE-2025-57809: XGrammar affected by Denial of Service by infinite recursion grammars

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-08-25 · updated 2026-06-17
• Weakness: CWE-674

Description

XGrammar is an open-source library for efficient, flexible, and portable structured generation. Prior to version 0.1.21, XGrammar has an infinite recursion issue in the grammar. This issue has been resolved in version 0.1.21.

Affected products

• mlc-ai xgrammar: before 0.1.21 — fixed in 0.1.21

How to fix

Upgrade to a fixed version: mlc-ai xgrammar 0.1.21. Check the vendor advisory for mitigations.

References

• https://github.com/mlc-ai/xgrammar/commit/b943feacb5a1caf4d39de8ec3bf7c7ce066dcee5
• https://github.com/mlc-ai/xgrammar/issues/250
• https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-5cmr-4px5-23pc

Get alerted when CVE-2025-57809 or the next vulnerability affects your stack