# CVE-2026-25048: mlc-ai xgrammar uncontrolled recursion in nested syntax

Source: https://junglewise.ai/threats/cve-2026-25048-mlc-ai-xgrammar-uncontrolled-recursion-in-nested-syntax  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-05. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-25048 · Severity: high · CVSS 7.5 · Published 2026-03-05

xgrammar is an open-source library used to ensure that AI models generate structured data, such as JSON or specific code formats. A vulnerability in how the library handles complex, nested instructions can cause the system to crash. This could allow an attacker to disrupt AI services, leading to a denial-of-service (DoS) condition where the AI becomes unavailable to legitimate users.

Technologies: [xgrammar (PyPI)](https://junglewise.ai/threats/technologies/xgrammar), [Red Hat AI Inference Server](https://junglewise.ai/threats/technologies/ai-inference-server). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-25048 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25048 being exploited in the wild.

**How severe is CVE-2026-25048?** High severity, with a CVSS score of 7.5, published 5 March 2026.

**Which products and versions are affected?** xgrammar (PyPI) ECOSYSTEM:introduced=0,fixed=0.1.32; Red Hat AI Inference Server 3.2.2.

**Is there a fix for CVE-2026-25048?** Yes. xgrammar (PyPI): upgrade to 0.1.32 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25048 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-25048?** Check whether you run xgrammar (PyPI) or Red Hat AI Inference Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- xgrammar (PyPI): upgrade to 0.1.32 or later

  ```sh
  pip install "xgrammar>=0.1.32"
  ```


## Technical details

A vulnerability exists in xgrammar prior to version 0.1.32 due to uncontrolled recursion (CWE-674) when parsing multi-level nested syntax. An attacker can exploit this by providing a malicious grammar rule containing deeply nested structures (e.g., 30,000 layers of parentheses), which triggers a stack overflow or memory exhaustion. This results in a segmentation fault and a core dump, leading to a denial-of-service (DoS) of the application utilizing the library. The issue is reachable over the network if the application allows user-defined or complex grammar inputs. The vulnerability has been patched in version 0.1.32.

## Affected products

- mlc-ai xgrammar < 0.1.32
- Red Hat Red Hat AI Inference Server 3.2.2
- Red Hat Red Hat OpenShift AI 2.25.7

## Identifiers

- CVE-2026-25048
- GHSA-7rgv-gqhr-fxg3
- PYSEC-2026-2322

## Timeline

- 2026-03-04: patched: Version 0.1.32 released
- 2026-03-05: advisory: GitHub Security Advisory published
- 2026-03-05: disclosed: CVE-2026-25048 published
- 2026-03-25: patched: Red Hat AI Inference Server 3.2.2 released

## References

- [https://github.com/mlc-ai/xgrammar/releases/tag/v0.1.32](https://github.com/mlc-ai/xgrammar/releases/tag/v0.1.32)
- [https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-7rgv-gqhr-fxg3](https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-7rgv-gqhr-fxg3)
- [https://access.redhat.com/errata/RHSA-2026:24977](https://access.redhat.com/errata/RHSA-2026:24977)
- [https://access.redhat.com/errata/RHSA-2026:5809](https://access.redhat.com/errata/RHSA-2026:5809)
- [https://access.redhat.com/errata/RHSA-2026:6761](https://access.redhat.com/errata/RHSA-2026:6761)
- [https://access.redhat.com/errata/RHSA-2026:6762](https://access.redhat.com/errata/RHSA-2026:6762)
- [https://access.redhat.com/security/cve/CVE-2026-25048](https://access.redhat.com/security/cve/CVE-2026-25048)

## Related threats

- [PYSEC-2026-2055 - xgrammar vulnerable to denial of service by huge enum grammar](https://junglewise.ai/threats/cve-2025-58446-xgrammar-vulnerable-to-denial-of-service-by-huge-enum-grammar)
- [PYSEC-2026-2054 - XGrammar affected by Denial of Service by infinite recursion grammars](https://junglewise.ai/threats/cve-2025-57809-xgrammar-affected-by-denial-of-service-by-infinite-recursion)
- [vLLM improper image metadata normalization in image processing](https://junglewise.ai/threats/vllm-improper-image-metadata-normalization-in-image-processing-68504b9d)
- [vLLM improper image metadata handling in image processing](https://junglewise.ai/threats/cve-2026-12491-vllm-improper-image-metadata-handling-in-image-processing)
- [Kludex python-multipart denial of service in multipart header parsing](https://junglewise.ai/threats/cve-2026-42561-kludex-python-multipart-denial-of-service-in-multipart-header)