GHSA-hf3c-wxg2-49q9: vLLM vulnerable to Denial of Service by abusing xgrammar cache

The vulnerability stems from an unbounded cache in the xgrammar library, which is used by vLLM for structured output. The patch (commit 549f429bfb26b58fe7ed33f2af8cf90b2bd71ae1) addresses this by upgrading xgrammar to a version with cache control (0.1.18) and modifying vLLM to utilize these new cache control features. Specifically, the patch introduces an environment variable VLLM_XGRAMMAR_CACHE_MB to set a cache size limit. The key changes are in how xgr.GrammarCompiler is instantiated within vLLM.

1. In vllm.model_executor.guided_decoding.xgrammar_decoding.XGrammarDecoder.get_compiler, the instantiation of xgr.GrammarCompiler was updated to include cache_enabled=True and cache_limit_bytes. Before this change, the compiler would use xgrammar's default (vulnerable) caching mechanism.
2. Similarly, in vllm.v1.structured_output.backend_xgrammar.XGrammarBackend.__init__, the instantiation of xgr.GrammarCompiler was also updated to pass these cache control parameters.

These two functions are directly responsible for creating and configuring the GrammarCompiler instances. In their pre-patch state, they were the points where vLLM invoked the xgrammar library in a way that exposed the unbounded cache vulnerability. Therefore, these functions would be active during the processing of requests that trigger the vulnerability, as they set up the component (the grammar compiler with its cache) that is being abused.