CVE-2026-123356 · Package
NO FIX YET · SEE WHAT TO DO
GROBID, a machine learning tool for extracting data from scholarly documents, creates a new thread pool on every call to its unauthenticated /api/modelTraining endpoint and never shuts it down. Repeated requests exhaust JVM and operating-system thread capacity, so an attacker can slow or stop document processing.
first public Jun 26, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any deployment of GROBID before 0.9.1 that exposes its REST API, especially to untrusted networks, is exposed because the training endpoint requires no authentication. Instances reachable only from a trusted internal network with the API restricted are lower risk. Teams that do not run GROBID can skip it.
Not affected if api-not-exposed, version-0.9.1-or-later
Who cares grobid, java, self-hosted
0.9.1./api/modelTraining.0.9.1.GROBID is machine learning software for extracting information from scholarly documents. Prior to 0.9.1, the unauthenticated /api/modelTraining endpoint calls GrobidRestProcessTraining.trainModel in GrobidRestProcessTraining.java, where each request creates Executors.newFixedThreadPool(1), submits a training task, and leaves the executor running. Repeated requests permanently retain JVM worker threads and can exhaust process or operating-system thread capacity, degrading or stopping request processing. This issue is fixed in version 0.9.1.
This page as .md ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.