CVE-2025-58446 xgrammar vulnerable to denial of service by huge enum grammar
Attackers can cause denial of service in model providers using xgrammar by submitting huge enum grammars that trigger inefficient processing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-58446?
CVE-2025-58446 is a medium-severity denial of service vulnerability in mlc-ai xgrammar, published on 6 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
xgrammar is an open-source library for efficient, flexible, and portable structured generation. A grammar optimizer introduced in 0.1.23 processes large grammars (>100k characters) at very low rates, and can be used for DOS of model providers. This issue is fixed in version 0.1.24.
Weakness: CWE-770
Which versions are affected by CVE-2025-58446?
3 open source packages ship an affected version, including xgrammar. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
xgrammar PyPI | From 0.1.23 | 0.1.24 |
xgrammar PyPI | From 0.1.23 | 0.1.24 |
xgrammar PyPI | From 0.1.23 | 0.1.24 |
Products include Mlc-Ai Xgrammar.
How do I fix CVE-2025-58446?
Upgrade xgrammar to 0.1.24 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-58446 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-58446 exists.
Other vulnerabilities in mlc-ai xgrammar
Sources
Also known as GHSA-9q5r-wfvf-rr7f, PYSEC-2026-2055.