CVE-2025-32381

XGrammar is an open-source library for efficient, flexible, and portable structured generation. Prior to 0.1.18, Xgrammar includes a cache for compiled grammars to increase performance with repeated use of the same grammar. This cache is held in memory. Since the cache is unbounded, a system making use of xgrammar can be abused to fill up a host's memory and case a denial of service. For example, sending many small requests to an LLM inference server with unique JSON schemas would eventually cause this denial of service to occur. This vulnerability is fixed in 0.1.18.

• CWE-770

• https://github.com/mlc-ai/xgrammar/pull/243Issue Tracking, Patch
• https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-389x-67px-mjg3Vendor Advisory
• https://github.com/vllm-project/vllm/pull/16283Issue Tracking, Patch

Published

Apr 9, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-32376Discourse is an open-source discussion platform. Prior to ve…4.3
• CVE-2025-32377Rasa Pro is a framework for building scalable, dynamic conve…6.5
• CVE-2025-32378Shopware is an open source e-commerce software platform. Pri…5.3
• CVE-2025-32379Koa is expressive middleware for Node.js using ES2017 async …6.1
• CVE-2025-3238A vulnerability classified as critical has been found in PHP…9.8
• CVE-2025-32380The Apollo Router Core is a configurable, high-performance g…7.5
• CVE-2025-32382Metabase is an open source Business Intelligence and Embedde…1.8
• CVE-2025-32383MaxKB (Max Knowledge Base) is an open source knowledge base …7.2
• CVE-2025-32385EspoCRM is an Open Source Customer Relationship Management s…6.5
• CVE-2025-32386Helm is a tool for managing Charts. A chart archive file can…6.5
• CVE-2025-32387Helm is a package manager for Charts for Kubernetes. A JSON …6.5
• CVE-2025-32388SvelteKit is a framework for rapidly developing robust, perf…5.4