CVE-2025-32381: mlc-ai xgrammar unbounded memory cache denial of service

CVE-2025-32381 · Severity: medium · CVSS 6.5 · Published 2025-04-09

Xgrammar, a library used to speed up Large Language Model (LLM) operations, contains a flaw where it stores processed data in a memory cache without any size limits. An attacker can exploit this by sending a large number of unique requests, eventually consuming all available system memory. This results in a denial-of-service (DoS) condition, causing the AI service to crash or become unresponsive.

Technologies: xgrammar (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2025-32381 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-32381 being exploited in the wild.
How severe is CVE-2025-32381?
Medium severity, with a CVSS score of 6.5, published 9 April 2025.
Which products and versions are affected?
xgrammar (PyPI) < 0.1.18, ECOSYSTEM:introduced=0,fixed=0.1.18.
Is there a fix for CVE-2025-32381?
Yes. xgrammar (PyPI): upgrade to 0.1.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-32381 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-32381?
Check whether you run xgrammar (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • xgrammar (PyPI): upgrade to 0.1.18 or later
    pip install "xgrammar>=0.1.18"

Technical details

Xgrammar (prior to version 0.1.18) implements an unbounded in-memory cache for compiled grammars to improve performance. This component lacks resource limits (CWE-770), allowing an authenticated network attacker to trigger continuous memory allocation by providing unique inputs, such as distinct JSON schemas in LLM inference requests. This leads to memory exhaustion and a Denial of Service (DoS) of the host system. The vulnerability is mitigated in version 0.1.18 by introducing a configurable cache size limit.

Affected products

  • mlc-ai xgrammar < 0.1.18

Identifiers

  • CVE-2025-32381
  • GHSA-389x-67px-mjg3
  • PYSEC-2025-235

Timeline

  • 2025-04-08: disclosed: Initial disclosure to mlc-ai/xgrammar
  • 2025-04-09: advisory: GitHub Advisory published
  • 2025-04-09: patched: Version 0.1.18 released with cache limits

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.