Read the docs
TI-2026-86070 Aliases CVE-2026-123356

Unbounded thread pool creation in GROBID model training endpoint

Priority LOW 33CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

GROBID, machine learning software for extracting information from scholarly documents, is affected before 0.9.1. The unauthenticated /api/modelTraining endpoint creates a new fixed thread pool for each request and never shuts it down, which is a missing resource limit (CWE-400). A remote attacker without credentials can send repeated requests to exhaust process or operating-system thread capacity, degrading or stopping request processing.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

GROBID is machine learning software for extracting information from scholarly documents. Prior to 0.9.1, the unauthenticated /api/modelTraining endpoint calls GrobidRestProcessTraining.trainModel in GrobidRestProcessTraining.java, where each request creates Executors.newFixedThreadPool(1), submits a training task, and leaves the executor running. Repeated requests permanently retain JVM worker threads and can exhaust process or operating-system thread capacity, degrading or stopping request processing. This issue is fixed in version 0.9.1.

Why it matters now

EPSS 0.0035 28th percentileScored 2026-11-07
Fix Fixed grobid (grobidOrg): 0.9.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
grobidOrggrobidbefore 0.9.10.9.1Patch availableCNA
  • grobid VendorgrobidOrg Affected before 0.9.1 Fixed in 0.9.1 Patch available CNA

Remediation

Upgrade GROBID to version 0.9.1, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA grobid (grobidOrg) Fixed in 0.9.1

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-123356
  2. 2026-11-08 Priority changed: MEDIUM → LOW

References

Other 4

  • TI-2026-86071 OS command injection in GROBID through crafted PDF filenames CVSS 3.1N/A 0.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences