SB20261109167 - Multiple vulnerabilities in XGrammar

Description

This security bulletin contains information about 2 vulnerabilities.

1) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated remote attacker to crash inference servers using XGrammar for regex constraints, causing denial of service.

The vulnerability exists due to an out-of-bounds read in XGrammar's regex-to-EBNF converter when null-terminated parsing of a regex beginning with a null byte produces an empty vector. An unauthenticated remote attacker can submit a single malformed regex through an exposed SGLang or vLLM API to terminate the host process.

2) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an unprivileged local attacker to cause memory corruption and terminate an application using XGrammar, resulting in denial of service.

The vulnerability exists due to missing range validation for grammar.allow_empty_rule_ids during compiled-grammar deserialization, allowing invalid rule IDs to trigger an out-of-bounds write during matcher construction. An unprivileged local attacker can supply a crafted compiled-grammar cache and induce a user to load it into an application that restores the cache and constructs a matcher.

Remediation

Install update from vendor's website.

References

• https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-ggf7-2pq3-j6pv
• https://github.com/mlc-ai/xgrammar/security/advisories/ghsa-m5hf-r6jr-m4q6
• https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-3gmq-qh92-5grm