High severity · published Aug 25, 2025
CVE-2025-57809
XGrammar affected by Denial of Service by infinite recursion grammars
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
XGrammar is an open-source library for efficient, flexible, and portable structured generation. Prior to version 0.1.21, XGrammar has an infinite recursion issue in the grammar. This issue has been resolved in version 0.1.21.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XG
xgrammar · mlc-ai
< 0.1.21 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-57809
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-57809
Patch
https://github.com/mlc-ai/xgrammar/commit/b943feacb5a1caf4d39de8ec3bf7c7ce066dcee5
Exploit
https://github.com/mlc-ai/xgrammar/issues/250
Vendor Advisory
https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-5cmr-4px5-23pc
More from xgrammar
7.5
CVE-2026-25048
xgrammar: Multi-layer nesting causes DoS
7.5
CVE-2025-58446
xgrammar vulnerable to denial of service by huge enum grammar
6.5
CVE-2025-32381
Denial of Service by abusing xgrammar unbounded cache in memory