{"id":"CVE-2026-123356","published":"2026-11-06T19:17:44.220","lastModified":"2026-11-09T23:17:15.083","description":"GROBID is machine learning software for extracting information from scholarly documents. Prior to 0.9.1, the unauthenticated /api/modelTraining endpoint calls GrobidRestProcessTraining.trainModel in GrobidRestProcessTraining.java, where each request creates Executors.newFixedThreadPool(1), submits a training task, and leaves the executor running. Repeated requests permanently retain JVM worker threads and can exhaust process or operating-system thread capacity, degrading or stopping request processing. This issue is fixed in version 0.9.1.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-400"],"vendors":[],"products":[],"references":[{"url":"https://github.com/grobidOrg/grobid/commit/3227e9a6a990ec1687173045f119c24e17d10103","tags":[]},{"url":"https://github.com/grobidOrg/grobid/pull/1477","tags":[]},{"url":"https://github.com/grobidOrg/grobid/releases/tag/0.9.1","tags":[]},{"url":"https://github.com/grobidOrg/grobid/security/advisories/GHSA-g2r5-4c8r-c84f","tags":[]}],"exploitRefs":[{"url":"https://github.com/grobidOrg/grobid/commit/3227e9a6a990ec1687173045f119c24e17d10103","tags":[]},{"url":"https://github.com/grobidOrg/grobid/pull/1477","tags":[]},{"url":"https://github.com/grobidOrg/grobid/releases/tag/0.9.1","tags":[]},{"url":"https://github.com/grobidOrg/grobid/security/advisories/GHSA-g2r5-4c8r-c84f","tags":[]}],"hasPoc":true,"ai":null}