CVE-2026-25048: 
Python vulnerability analysis and mitigation

CVE-2026-25048 is a Denial of Service (DoS) vulnerability in xgrammar, an open-source Python library by mlc-ai for efficient, flexible, and portable structured generation used in LLM inference pipelines. The vulnerability exists in versions up to and including 0.1.31, where processing multi-level nested grammar syntax triggers uncontrolled recursion, causing a segmentation fault (core dump). It was disclosed on March 5, 2026, by researcher ylwango613 via the GitHub Security Advisory GHSA-7rgv-gqhr-fxg3. The vulnerability carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is CWE-674 (Uncontrolled Recursion): xgrammar's grammar compiler does not impose limits on recursion depth when parsing nested grammar rules, allowing the call stack or memory to be exhausted. An attacker can craft a malicious grammar string containing an extreme number of nested parentheses (e.g., 30,000 layers) and submit it to any application that passes user-controlled input to xgr.GrammarCompiler.compile_grammar(). No authentication, privileges, or user interaction are required — the attack vector is network-accessible wherever the library processes externally supplied grammar strings. A public PoC written in Python is available in the official security advisory, demonstrating the crash with a grammar of the form root ::= (((...a...))) with 30,000 nesting levels (GitHub Advisory).

Successful exploitation causes the host process to crash with a segmentation fault, resulting in complete loss of availability for any service relying on xgrammar for structured generation (e.g., LLM inference APIs). There is no impact on confidentiality or data integrity — the vulnerability is purely a DoS condition. Repeated exploitation could keep a targeted service continuously unavailable, and in multi-tenant or shared inference environments, a single crash may affect all users of that service (GitHub Advisory, Feedly).

A public proof-of-concept (PoC) Python script is included in the official GitHub Security Advisory and demonstrates reliable crash reproduction on xgrammar 0.1.31. The EPSS score is approximately 0.042% (24th percentile), indicating low current exploitation probability. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the time of this report (GitHub Advisory, Feedly).

1. Identify target: Locate a network-accessible service or API that accepts user-supplied grammar strings and processes them using xgrammar versions ≤ 0.1.31 (e.g., an LLM inference endpoint with structured generation support).
2. Craft malicious grammar: Construct a grammar string with extreme nesting depth, such as s = '(' * 30000 + 'a' and grammar = f'root ::= {s}', which creates 30,000 layers of nested parentheses.
3. Submit the payload: Send the malicious grammar to the target application via its API or input interface — for example, as a grammar parameter in a structured generation request.
4. Trigger the crash: When the application calls xgr.GrammarCompiler(tokenizer_info).compile_grammar(malicious_grammar), the uncontrolled recursion exhausts the stack or memory, causing a segmentation fault and crashing the process.
5. Achieve DoS: The service becomes unavailable; repeat submissions can prevent recovery if the application auto-restarts without input validation (GitHub Advisory).

• Logs: Application logs showing abrupt process termination with Segmentation fault (core dumped) messages from the Python process running xgrammar; absence of a clean shutdown sequence.
• Process: Unexpected crash of the Python/LLM inference process; core dump files (e.g., core, core.<pid>) generated in the working directory of the xgrammar-using application.
• Network: Unusual or repeated API requests containing grammar strings with abnormally long or deeply nested parenthetical structures submitted to structured generation endpoints.
• File System: Presence of core dump files (core.*) in the application's working directory following service crashes (GitHub Advisory).

The primary remediation is to upgrade xgrammar to version 0.1.32 or later, which patches the uncontrolled recursion issue (pip install xgrammar>=0.1.32) (GitHub Release). If immediate patching is not feasible, implement input validation to reject grammar strings exceeding a safe nesting depth before passing them to compile_grammar(). Additionally, monitor applications for unexpected crashes or segmentation faults that may indicate exploitation attempts. Red Hat has also issued advisories (RHSA-2026:5809, RHSA-2026:6761, RHSA-2026:6762) for affected downstream packages (Red Hat Bugzilla).

The vulnerability was reported by researcher ylwango613 and published by the xgrammar maintainer Seven-Streams via GitHub's security advisory process on March 5, 2026. Red Hat tracked the issue via Bugzilla (Bug 2444840) and subsequently issued multiple errata (RHSA-2026:5809, RHSA-2026:6761, RHSA-2026:6762), indicating downstream impact on Red Hat products that bundle xgrammar. Community discussion was limited, with automated vulnerability aggregators (Vulners, VulDB, CIRCL) picking up the advisory shortly after disclosure; no significant independent researcher commentary or media coverage was identified (Red Hat Bugzilla, GitHub Advisory).