Skip to main content

Allocation of Resources Without Limits or Throttling

CVE-2025-32381

Medium
6.5/10

Summary

XGrammar is an open-source library for efficient, flexible, and portable structured generation. XGrammar included a cache for compiled grammars to improve performance with repeated use of the same grammar. This cache is held in memory. Since the cache is unbounded, a system using XGrammar can be abused to exhaust the host's memory and cause a Denial of Service (DoS). For example, sending many small requests to an LLM inference server with unique JSON schemas could eventually trigger this condition. This issue affects xgrammar versions through 0.1.17.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • LOW
  • NONE
  • HIGH

CWE-770 - Allocation of Resources Without Limits or Throttling

The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References

Advisory Timeline

  • Published