xgrammar: Multi-layer nesting causes DoS

CVE-2026-25048 is a denial-of-service vulnerability in xgrammar, an open-source library for structured generation. The issue arises from improper handling of multi-level nested syntax in grammar definitions, which triggers a segmentation fault (core dump) when processed [1][3].

An attacker can exploit this by providing a crafted grammar rule containing an excessive number of nested parentheses—for example, 30,000 layers—as demonstrated in the proof-of-concept [3]. This causes a stack overflow or memory exhaustion during grammar compilation, leading to a crash of the application using xgrammar [3].

The impact is a denial of service, as the segmentation fault terminates the process. No authentication or special privileges are required if the attacker can supply a grammar to the library, making it exploitable in any service that accepts user-defined grammars [3].

The vulnerability has been patched in xgrammar version 0.1.32 [4]. Users are advised to upgrade to the latest version. No workarounds are documented; the fix addresses the root cause by improving handling of deeply nested syntax [4].