CVE-2025-58446 MEDIUM

CVE-2025-58446: xgrammar vulnerable to denial of service by huge enum grammar

Vendor Mlc-Ai

Product xgrammar

Weakness CWE-770 · Uncontrolled resource consumption

Published September 6, 2025

Last update September 8, 2025

View on NVD All CVEs

CVSS base score

6.9/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

xgrammar is an open-source library for efficient, flexible, and portable structured generation. A grammar optimizer introduced in 0.1.23 processes large grammars (>100k characters) at very low rates, and can be used for DOS of model providers. This issue is fixed in version 0.1.24.

Key dates

02Disclosure timeline

September 6, 2025 CVE published

September 8, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-58446 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/770.html

Related vulnerabilities

04Related CVE

CVE-2025-14435 Application-Level DoS via infinite re-render loop in user profile handling CVE-2022-3480 Denial-of-Service vulnerability in PHOENIX CONTACT mGuard product family CVE-2026-56150 Allocation of Resources Without Limits or Throttling in Fleet Server Leading to Denial of Service CVE-2026-33219 NATS is vulnerable to pre-auth DoS through WebSockets client service CVE-2025-32380 Apollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment Processing