EUVD-2007-5371

Malware in sbrugna...

EUVD-2025-29404

Malicious code in bioql PyPI...

EUVD-2025-29475

Malicious code in bioql PyPI...

EUVD-2023-1128

Malicious code in bioql PyPI...

EUVD-2025-27083

Malicious code in bioql PyPI...

CVE-2025-58446

xgrammar is an open-source library for efficient, flexible, and portable structured generation. A grammar optimizer introduced in 0.1.23 processes large grammars 100k characters at very low rates, and can be used for DOS of model providers. This issue is fixed in version 0.1.24. Mitigation Upgrad...

Allocation of Resources Without Limits or Throttling

Overview xgrammar is an Efficient, Flexible and Portable Structured Generation Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to wrong boundary check in the earley parser. An attacker can cause resource exhaustion and disrupt service...

CVE-2025-58446

xgrammar is an open-source library for efficient, flexible, and portable structured generation. A grammar optimizer introduced in 0.1.23 processes large grammars 100k characters at very low rates, and can be used for DOS of model providers. This issue is fixed in version 0.1.24...

CVE-2025-58446

xgrammar is an open-source library for efficient, flexible, and portable structured generation. A grammar optimizer introduced in 0.1.23 processes large grammars 100k characters at very low rates, and can be used for DOS of model providers. This issue is fixed in version 0.1.24...

CVE-2025-58446 xgrammar vulnerable to denial of service by huge enum grammar

xgrammar is an open-source library for efficient, flexible, and portable structured generation. A grammar optimizer introduced in 0.1.23 processes large grammars 100k characters at very low rates, and can be used for DOS of model providers. This issue is fixed in version 0.1.24...

CVE-2025-58446 xgrammar vulnerable to denial of service by huge enum grammar

xgrammar is an open-source library for efficient, flexible, and portable structured generation. A grammar optimizer introduced in 0.1.23 processes large grammars 100k characters at very low rates, and can be used for DOS of model providers. This issue is fixed in version 0.1.24...

CVE-2025-58446: Allocation of Resources Without Limits or Throttling

xgrammar is an open-source library for efficient, flexible, and portable structured generation. A grammar optimizer introduced in 0.1.23 processes large grammars 100k characters at very low rates, and can be used for DOS of model providers. This issue is fixed in version 0.1.24...

GHSA-9Q5R-WFVF-RR7F xgrammar vulnerable to denial of service by huge enum grammar

Summary Provided grammar, would fit in a context window of most of the models, but takes minutes to process in 0.1.23. In testing with 0.1.16 the parser worked fine so this seems to be a regression caused by Earley parser. Details Full reproducer provider in the POC section. The resulting grammar...

xgrammar vulnerable to denial of service by huge enum grammar

Summary Provided grammar, would fit in a context window of most of the models, but takes minutes to process in 0.1.23. In testing with 0.1.16 the parser worked fine so this seems to be a regression caused by Earley parser. Details Full reproducer provider in the POC section. The resulting grammar...

PT-2025-36398

Name of the Vulnerable Software and Affected Versions xgrammar versions 0.1.23 Description xgrammar is an open-source library for efficient, flexible, and portable structured generation. A grammar optimizer introduced in version 0.1.23 can be exploited to cause a denial-of-service DOS attack on...

Picklescan has a missing detection when calling built-in python lib2to3.pgen2.grammar.Grammar.loads

Summary Using lib2to3.pgen2.grammar.Grammar.loads, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to lib2to3.pgen2.grammar.Grammar.loads function in reduce meth...

GHSA-F54Q-57X4-JG88 Picklescan has a missing detection when calling built-in python lib2to3.pgen2.grammar.Grammar.loads

Summary Using lib2to3.pgen2.grammar.Grammar.loads, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to lib2to3.pgen2.grammar.Grammar.loads function in reduce meth...

PT-2026-55672

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.29 Description The software fails to detect malicious pickle payloads that utilize the lib2to3.pgen2.grammar.Grammar.loads function within the reduce method. This flaw allows remote code execution, as attackers...

CVE-2025-57809

CVE-2025-57809 affects XGrammar. Prior to 0.1.21, there is an infinite recursion issue in the grammar; this is resolved in version 0.1.21. CVSSv3.1 base score 7.5 (HIGH) with availability impact; CVSS4 base score 8.7 (HIGH) with high availability impact. Remediation: upgrade XGrammar to 0.1.21 or...

Linux Distros Unpatched Vulnerability : CVE-2017-5923

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service heap-based out-of- bounds read and application crash via a crafted rule tha...