CVE-2026-25048: xgrammar: Multi-layer nesting causes DoS

Description

xgrammar is an open-source library for efficient, flexible, and portable structured generation. Prior to version 0.1.32, the multi-level nested syntax caused a segmentation fault (core dumped). This issue has been patched in version 0.1.32.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.2% · higher than 68% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

XG

xgrammar · mlc-ai

< 0.1.32 · source: vendor, NVD

RH

Red Hat AI Inference Server · Red Hat

All versions, or not specified · source: CISA

RH

Red Hat AI Inference Server 3.2 · Red Hat

All versions, or not specified · source: CISA

RH

Red Hat Enterprise Linux AI (RHEL AI) 3 · Red Hat

All versions, or not specified · source: CISA

RH

Red Hat OpenShift AI 2.25 · Red Hat

All versions, or not specified · source: CISA