---
id: CVE-2025-32381
aliases:
  - GHSA-389x-67px-mjg3
  - PYSEC-2025-235
title: >-
  xgrammar Vulnerable to Denial of Service (DoS) by abusing unbounded cache in
  memory
summary: >-
  xgrammar Vulnerable to Denial of Service (DoS) by abusing unbounded cache in
  memory
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
vendor: xgrammar
product: xgrammar
ecosystem: pip
affected:
  - xgrammar < 0.1.18
patched:
  - xgrammar 0.1.18
published: '2025-04-09'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:57.150873872Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-389x-67px-mjg3'
references:
  - url: 'https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-389x-67px-mjg3'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-32381'
  - url: 'https://github.com/mlc-ai/xgrammar/pull/243'
  - url: 'https://github.com/vllm-project/vllm/pull/16283'
  - url: 'https://github.com/mlc-ai/xgrammar'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/xgrammar/PYSEC-2025-235.yaml
tags:
  - osv
  - pip
epss: 0.00498
epssPercentile: 0.40156
ingestedAt: '2026-08-07T19:14:13.849Z'
---

## Overview

### Summary

Xgrammar includes a cache for compiled grammars to increase performance with repeated use of the same grammar. This cache is held in memory. Since the cache is unbounded, a system making use of xgrammar can be abused to fill up a host's memory and case a denial of service. For example, sending many small requests to an LLM inference server with unique JSON schemas would eventually cause this denial of service to occur.

### Details

The fix is to add a limit to the cache size. This was done in https://github.com/mlc-ai/xgrammar/pull/243

An example of making use of the new cache size limit can be found in vLLM here: https://github.com/vllm-project/vllm/pull/16283

### Impact

Any system making use of Xgrammar and taking requests as input from potentially untrusted parties would be vulnerable to this denial of service issue.

## Affected packages

- `xgrammar < 0.1.18`

## Remediation

Upgrade to a patched release:

- `xgrammar 0.1.18`