Resource Exhaustion Vulnerability in GROBID Machine Learning Software

CVE-2026-123356

What is CVE-2026-123356?

GROBID, a machine learning software designed for extracting information from scholarly documents, contains a resource exhaustion vulnerability that can be triggered through its unauthenticated /api/modelTraining endpoint. This flaw is due to the endpoint's implementation, where each request creates a new fixed thread pool for training tasks, ultimately leading to an accumulation of JVM worker threads. Repeated invocations of this endpoint can exhaust system resources, particularly the thread capacity of the process or operating system, resulting in degraded performance or complete failure to process future requests. Users are advised to upgrade to version 0.9.1, which addresses this issue.

References