{"id":"CVE-2026-25048","aliases":["GHSA-7rgv-gqhr-fxg3","PYSEC-2026-2322"],"url":"https://o3.security/vulnerability/CVE-2026-25048","summary":"xgrammar: Multi-layer nesting causes DoS","details":"xgrammar is an open-source library for efficient, flexible, and portable structured generation. Prior to version 0.1.32, the multi-level nested syntax caused a segmentation fault (core dumped). This issue has been patched in version 0.1.32.","published":"2026-03-05T15:34:42.095Z","modified":"2026-08-05T03:31:50.624316740Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"xgrammar","fixedVersion":"0.1.32"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/mlc-ai/xgrammar/releases/tag/v0.1.32"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25048.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24977"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42644"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:5809"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:6761"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:6762"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-25048"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25048.json"},{"type":"ADVISORY","url":"https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-7rgv-gqhr-fxg3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25048"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2444840"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-05T03:31:50.624316740Z"}}