GHSA-hf3c-wxg2-49q9 vLLM vulnerable to Denial of Service by abusing xgrammar cache
Attackers can cause Denial of Service by exhausting RAM via unique schema requests in vLLM's xgrammar cache.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-hf3c-wxg2-49q9?
GHSA-hf3c-wxg2-49q9 is a denial of service vulnerability in vllm, published on 15 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
This report is to highlight a vulnerability in XGrammar, a library used by the structured output feature in vLLM. The XGrammar advisory is here: https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-389x-67px-mjg3
The xgrammar library is the default backend used by vLLM to support structured output (a.k.a. guided decoding). Xgrammar provides a required, built-in cache for its compiled grammars stored in RAM. xgrammar is available by default through the OpenAI compatible API server with both the V0 and V1 engines.
A malicious user can send a stream of very short decoding requests with unique schemas, resulting in an addition to the cache for each request. This can result in a Denial of Service by consuming all of the system's RAM.
Note that even if vLLM was configured to use a different backend by default, it is still possible to choose xgrammar on a per-request basis using the guided_decoding_backend key of the extra_body field of the request with the V0 engine. This per-request choice is not available when using the V1 engine.
Patches
Workarounds
There is no way to workaround this issue in existing versions of vLLM other than preventing untrusted access to the OpenAI compatible API server.
References
Which versions are affected by GHSA-hf3c-wxg2-49q9?
2 open source packages ship an affected version, including vllm.
| Package | Affected | Fixed in |
|---|---|---|
vllm PyPI | From 0.6.5 | 0.8.4 |
vllm PyPI | From 0.6.5 | 0.8.4 |
How do I fix GHSA-hf3c-wxg2-49q9?
Upgrade vllm to 0.8.4 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-hf3c-wxg2-49q9 being exploited?
There is no known exploitation of GHSA-hf3c-wxg2-49q9 in the wild and no public exploit code.