Denial of Service Vulnerability in vLLM due to XGrammar Cache Abuse
Summary
GHSA-hf3c-wxg2-49q9: vLLM vulnerable to Denial of Service by abusing xgrammar cache. Affects vllm versions >= 0.6.5, < 0.8.4. Fixed in 0.8.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vLLM is an open-source library designed for efficient language model serving, particularly optimized for structured output through guided decoding. It utilizes the XGrammar library as its default backend for managing structured outputs. XGrammar features a built-in cache for compiled grammars, which is stored in RAM to enhance performance. However, this caching mechanism can be exploited, leading to potential Denial of Service (DoS) attacks.
Vulnerability Detail
The vulnerability arises from the way XGrammar manages its cache for compiled grammars. A malicious user can exploit this by sending a continuous stream of short decoding requests with unique schemas. Each request adds a new entry to the cache, which can quickly exhaust the system's RAM, resulting in a Denial of Service. This issue is particularly concerning as it can be triggered even if vLLM is configured to use a different backend by default, allowing attackers to specify XGrammar on a per-request basis with the V0 engine.
How To Fix
Latest published version: 0.32.0 as of 22 Oct 2026
pip install --upgrade "vllm==0.32.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.8.4
This is the first release that contains the fix.
pip install --upgrade "vllm==0.8.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no effective workarounds for this vulnerability in existing versions of vLLM other than restricting access to the OpenAI compatible API server to trusted users only.
Conclusion
The Denial of Service vulnerability in vLLM due to XGrammar cache abuse poses a significant risk to systems utilizing this library. It is crucial to update to the latest version to protect against potential attacks. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for vllm →
FAQ
The vulnerability allows a malicious user to exploit the XGrammar cache, leading to potential Denial of Service by consuming all available system RAM.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
The CVSS score for this vulnerability is 6.5, indicating a moderate severity level.
Yes, a patch is available in version 0.8.4 of the vLLM package. It is recommended to upgrade to this version to mitigate the vulnerability.
If an immediate upgrade is not possible, restrict access to the OpenAI compatible API server to trusted users to minimize the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for vllm.
