id: PYSEC-2026-2322
published: "2026-03-05T16:16:15.853Z"
modified: "2026-07-13T05:52:37.795063Z"
aliases:
- CVE-2026-25048
- GHSA-7rgv-gqhr-fxg3
details: xgrammar is an open-source library for efficient, flexible, and portable structured generation. Prior to version 0.1.32, the multi-level nested syntax caused a segmentation fault (core dumped). This issue has been patched in version 0.1.32.
affected:
- package:
    name: xgrammar
    ecosystem: PyPI
    purl: pkg:pypi/xgrammar
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.1.32
  versions:
  - 0.1.0
  - 0.1.1
  - 0.1.10
  - 0.1.11
  - 0.1.12
  - 0.1.13
  - 0.1.14
  - 0.1.15
  - 0.1.16
  - 0.1.17
  - 0.1.18
  - 0.1.19
  - 0.1.2
  - 0.1.20
  - 0.1.21
  - 0.1.22
  - 0.1.23
  - 0.1.24
  - 0.1.25
  - 0.1.26
  - 0.1.27
  - 0.1.28
  - 0.1.29
  - 0.1.3
  - 0.1.30
  - 0.1.31
  - 0.1.4
  - 0.1.4rc2
  - 0.1.5
  - 0.1.5rc1
  - 0.1.6
  - 0.1.7
  - 0.1.8
  - 0.1.9
  ecosystem_specific: {}
references:
- type: WEB
  url: https://access.redhat.com/security/cve/CVE-2026-25048
- type: WEB
  url: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25048.json
- type: ADVISORY
  url: https://access.redhat.com/errata/RHSA-2026:24977
- type: ADVISORY
  url: https://access.redhat.com/errata/RHSA-2026:5809
- type: ADVISORY
  url: https://access.redhat.com/errata/RHSA-2026:6761
- type: ADVISORY
  url: https://access.redhat.com/errata/RHSA-2026:6762
- type: ADVISORY
  url: https://github.com/mlc-ai/xgrammar/releases/tag/v0.1.32
- type: REPORT
  url: https://bugzilla.redhat.com/show_bug.cgi?id=2444840
- type: EVIDENCE
  url: https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-7rgv-gqhr-fxg3
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H