CVE-2026-123356

Name of the Vulnerable Software and Affected Versions GROBID versions prior to 0.9.1

Description The unauthenticated '/api/modelTraining' endpoint calls the trainModel() function in GrobidRestProcessTraining.java. Each request creates a new fixed thread pool via Executors.newFixedThreadPool(1), submits a training task, and leaves the executor running. Repeated requests cause the permanent retention of JVM worker threads, which can exhaust the thread capacity of the process or operating system, leading to degraded performance or a complete stop in request processing.

Recommendations Update to version 0.9.1. As a temporary workaround, restrict access to the '/api/modelTraining' endpoint.