CVE-2025-58446

Executive Summary

CVE-2025-58446 is a Denial of Service (DoS) vulnerability in the Xgrammar open-source library, specifically affecting the grammar optimizer introduced in version 0.1.23. The optimizer processes large grammars (over 100,000 characters) at very low rates, allowing an attacker to submit a crafted, oversized grammar that consumes excessive server resources, leading to a denial of service for model providers using the library. The vulnerability is fixed in version 0.1.24.

Supply Chain & Package Security

Xgrammar is a Python library available on PyPI. The vulnerability affects any application that integrates Xgrammar and exposes grammar processing to untrusted input. Attackers can exploit this by sending large grammar payloads to public-facing APIs or services that use Xgrammar for structured generation, causing resource exhaustion and service disruption.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High
• Threat Level: High – Exploitation is straightforward with no authentication required, and the impact is complete service denial.

Deep Dive & Mechanics

The vulnerability resides in the grammar optimizer module introduced in Xgrammar 0.1.23. The optimizer is designed to process and optimize grammar definitions for structured generation tasks. However, it lacks proper resource limits when handling large grammars (exceeding 100,000 characters). When a grammar of this size is submitted, the optimizer enters a low-rate processing loop that consumes excessive CPU and memory resources, effectively starving other processes and causing a denial of service.

The root cause is the absence of input size validation and resource throttling. The optimizer attempts to process the entire grammar without any checks on its length or complexity, leading to unbounded resource consumption. An attacker can exploit this by sending a single HTTP request containing a large grammar to any service that uses Xgrammar's grammar optimizer.

Vulnerable vs. Patched Code

Vulnerable Code (version 0.1.23):

def optimize_grammar(grammar: str) -> str:
    # No size check or resource limit
    optimized = _internal_optimize(grammar)
    return optimized

Patched Code (version 0.1.24):

MAX_GRAMMAR_SIZE = 100000  # 100k characters

def optimize_grammar(grammar: str) -> str:
    if len(grammar) > MAX_GRAMMAR_SIZE:
        raise ValueError("Grammar exceeds maximum allowed size")
    optimized = _internal_optimize(grammar)
    return optimized

The patch introduces a maximum grammar size check (100,000 characters) and raises an exception if the input exceeds this limit, preventing resource exhaustion.

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

1. Deploy a vulnerable Xgrammar service (version 0.1.23) on a local server.
2. Use a tool like curl or a Python script to send a crafted large grammar.

Exploit Payload:

import requests

# Generate a grammar string > 100k characters
large_grammar = "A" * 200000  # 200k characters

# Target endpoint (example)
url = "http://target:8080/optimize"

# Send the malicious request
response = requests.post(url, data={"grammar": large_grammar})
print(f"Status: {response.status_code}")

Expected Outcome: The target service becomes unresponsive or crashes due to resource exhaustion.

Blue Team (Defender)

Detection:

• Monitor for requests with unusually large payloads (e.g., > 100k characters) to grammar optimization endpoints.
• Set up alerts for high CPU/memory usage on servers running Xgrammar.

Mitigation:

• Immediately upgrade to Xgrammar version 0.1.24 or later.
• Implement input size validation at the application level (e.g., reject grammars > 100k characters).
• Use rate limiting and resource quotas for grammar processing endpoints.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to grammar optimization endpoints with payloads exceeding 100,000 characters.
• System: High CPU and memory usage on servers running Xgrammar 0.1.23.
• Logs: Application logs showing repeated processing of large grammar strings.
• File: Grammar input files larger than 100k characters submitted to the service.

Detection Engineering

YARA Rule

rule CVE_2025_58446_Xgrammar_DoS {
    meta:
        description = "Detects large grammar payloads targeting Xgrammar DoS vulnerability"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-58446"
    strings:
        $large_grammar = /.{100001,}/  // Matches strings > 100k characters
    condition:
        $large_grammar
}

Sigma Rule

title: Xgrammar Large Grammar DoS Attempt
id: 8f4b3c2a-1e5d-4f7a-9b8c-0d1e2f3a4b5c
status: experimental
description: Detects HTTP requests with grammar payloads exceeding 100k characters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        http.request.body|length: > 100000
        http.request.body|contains: "grammar"
    condition: selection
falsepositives:
    - Legitimate large grammar submissions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-58446 Xgrammar Large Grammar DoS Attempt"; flow:to_server; content:"grammar"; http_client_body; byte_test:0,>,100000,0,string,dec; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade Xgrammar to version 0.1.24 or later.
2. Short-term: Implement input validation to reject grammars larger than 100,000 characters.
3. Long-term: Add rate limiting and resource monitoring for grammar processing endpoints.
4. Compensating Controls: Use Web Application Firewall (WAF) rules to block oversized payloads.

Valters IT
Securing the digital frontier, one CVE at a time.