CVE-2026-123356 GROBID: Unauthenticated `/api/modelTraining` Endpoint Allows Unbounded Thread Pool Creation (DoS)
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123356?
CVE-2026-123356 is a high-severity vulnerability in grobidOrg grobid, published on 6 Nov 2026.
Official description
GROBID is machine learning software for extracting information from scholarly documents. Prior to 0.9.1, the unauthenticated /api/modelTraining endpoint calls GrobidRestProcessTraining.trainModel in GrobidRestProcessTraining.java, where each request creates Executors.newFixedThreadPool(1), submits a training task, and leaves the executor running. Repeated requests permanently retain JVM worker threads and can exhaust process or operating-system thread capacity, degrading or stopping request processing. This issue is fixed in version 0.9.1.
Weakness: CWE-400
Which versions are affected by CVE-2026-123356?
How do I fix CVE-2026-123356?
No fix has been published for CVE-2026-123356 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123356 being exploited?
There is no known exploitation of CVE-2026-123356 in the wild and no public exploit code.
Sources
Also known as GHSA-g2r5-4c8r-c84f.