Skip to content
OpenAdvisories
High · 7.5 CVE-2026-123356 EUVD-2026-118414

GROBID: Unauthenticated `/api/modelTraining` Endpoint Allows Unbounded Thread Pool Creation (DoS)

Published Nov 6, 2026 · Updated Nov 9, 2026 · Assigned by GitHub_M

Description

GROBID is machine learning software for extracting information from scholarly documents. Prior to 0.9.1, the unauthenticated /api/modelTraining endpoint calls GrobidRestProcessTraining.trainModel in GrobidRestProcessTraining.java, where each request creates Executors.newFixedThreadPool(1), submits a training task, and leaves the executor running. Repeated requests permanently retain JVM worker threads and can exhaust process or operating-system thread capacity, degrading or stopping request processing. This issue is fixed in version 0.9.1.

Affected products

VendorProductAffectedFixed
grobidOrg grobid < 0.9.1 —

References