HIGH 7.5 NVD
CVE-2026-123356
GROBID is machine learning software for extracting information from scholarly documents. Prior to 0.9.1, the unauthenticated /api/modelTraining endpoint calls G
GROBID is machine learning software for extracting information from scholarly documents. Prior to 0.9.1, the unauthenticated /api/modelTraining endpoint calls GrobidRestProcessTraining.trainModel in GrobidRestProcessTraining.java, where each request creates Executors.newFixedThreadPool(1), submits a training task, and leaves the executor running. Repeated requests permanently retain JVM worker threads and can exhaust process or operating-system thread capacity, degrading or stopping request processing. This issue is fixed in version 0.9.1.
References
- https://github.com/grobidOrg/grobid/commit/3227e9a6a990ec1687173045f119c24e17d10103
- https://github.com/grobidOrg/grobid/pull/1477
- https://github.com/grobidOrg/grobid/releases/tag/0.9.1
- https://github.com/grobidOrg/grobid/security/advisories/GHSA-g2r5-4c8r-c84f
This high severity vulnerability with a CVSS score of 7.5 was published on 2026-11-06 via NVD.
vulnfeed aggregates 16326 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.