Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2025-58446

Опубликовано: 06 сент. 2025
Источник: redhat
CVSS3: 7.5
EPSS Низкий

Описание

xgrammar is an open-source library for efficient, flexible, and portable structured generation. A grammar optimizer introduced in 0.1.23 processes large grammars (>100k characters) at very low rates, and can be used for DOS of model providers. This issue is fixed in version 0.1.24.

Отчет

This vulnerability is rated as a moderate severity because there is an algorithmic complexity vulnerability exists in the grammar optimizer component, where a remote, unauthenticated attacker can trigger this flaw with low complexity by submitting a specially crafted, large grammar (over 100,000 characters) for processing. This action leads to excessive CPU consumption and prolonged processing delays, causing a Denial of Service (DoS) and compromising system Availability.

Меры по смягчению последствий

Upgrade to xgrammar version 0.1.24 or later. The patched version directly addresses the root cause by optimizing the speed of the grammar optimizer and disabling certain slow optimization routines when processing very large grammars. This action prevents the excessive processing time that leads to the DoS condition.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat AI Inference Serverrhaiis/vllm-cuda-rhel9Not affected
Red Hat AI Inference Serverrhaiis/vllm-rocm-rhel9Not affected
Red Hat AI Inference Serverrhaiis/vllm-tpu-rhel9Not affected
Red Hat Enterprise Linux AI (RHEL AI)rhelai1/bootc-amd-rhel9Not affected
Red Hat Enterprise Linux AI (RHEL AI)rhelai1/bootc-aws-nvidia-rhel9Not affected
Red Hat Enterprise Linux AI (RHEL AI)rhelai1/bootc-azure-amd-rhel9Not affected
Red Hat Enterprise Linux AI (RHEL AI)rhelai1/bootc-azure-nvidia-rhel9Not affected
Red Hat Enterprise Linux AI (RHEL AI)rhelai1/bootc-gcp-nvidia-rhel9Not affected
Red Hat Enterprise Linux AI (RHEL AI)rhelai1/bootc-intel-rhel9Not affected
Red Hat Enterprise Linux AI (RHEL AI)rhelai1/bootc-nvidia-rhel9Not affected

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-770
https://bugzilla.redhat.com/show_bug.cgi?id=2393665xgrammar: xgrammar vulnerable to denial of service by huge enum grammar

EPSS

Процентиль: 24%
0.00081
Низкий

7.5 High

CVSS3

Связанные уязвимости

CVSS3: 7.5
nvd
3 месяца назад

xgrammar is an open-source library for efficient, flexible, and portable structured generation. A grammar optimizer introduced in 0.1.23 processes large grammars (>100k characters) at very low rates, and can be used for DOS of model providers. This issue is fixed in version 0.1.24.

github
3 месяца назад

xgrammar vulnerable to denial of service by huge enum grammar

EPSS

Процентиль: 24%
0.00081
Низкий

7.5 High

CVSS3