CVE-2025-32381: mlc-ai xgrammar unbounded memory cache denial of service

Executive brief

Xgrammar, a library used to speed up Large Language Model (LLM) operations, contains a flaw where it stores processed data in a memory cache without any size limits. An attacker can exploit this by sending a large number of unique requests, eventually consuming all available system memory. This results in a denial-of-service (DoS) condition, causing the AI service to crash or become unresponsive.

Technical details

Xgrammar (prior to version 0.1.18) implements an unbounded in-memory cache for compiled grammars to improve performance. This component lacks resource limits (CWE-770), allowing an authenticated network attacker to trigger continuous memory allocation by providing unique inputs, such as distinct JSON schemas in LLM inference requests. This leads to memory exhaustion and a Denial of Service (DoS) of the host system. The vulnerability is mitigated in version 0.1.18 by introducing a configurable cache size limit.

Affected products

• mlc-ai xgrammar < 0.1.18

Timeline

• 2025-04-08: disclosed: Initial disclosure to mlc-ai/xgrammar
• 2025-04-09: advisory: GitHub Advisory published
• 2025-04-09: patched: Version 0.1.18 released with cache limits

References

• https://api.github.com/users/russellb
• https://github.com/russellb
• https://api.github.com/users/russellb/gists%7B/gist_id%7D
• https://api.github.com/users/russellb/repos
• https://avatars.githubusercontent.com/u/309258?v=4
• https://api.github.com/users/russellb/events%7B/privacy%7D