Uncontrolled recursion in xgrammar causes the library to crash via a segmentation fault when parsing multi‑layer nested syntax. The fault results in a core dump and service termination, denying availability to any consuming application. The weakness is identified as CWE‑674, an uncontrolled recursion that can be exploited by supplying maliciously nested input to the parser.

The vulnerability affects the open‑source xgrammar library produced by mlc‑ai. All versions prior to 0.1.32 are impacted. The issue was addressed in release 0.1.32 and later.

The CVSS score of 8.7 indicates a high severity denial‑of‑service vulnerability. The EPSS score is less than 1 %, implying a very low current probability of exploitation, and the flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could trigger the fault by supplying deeply nested syntax to the parser, leading to a segmentation fault and service crash.