{"affected":[{"product":"grobid","source":"CNA: GitHub_M","vendor":"grobidOrg","versions":[{"status":"affected","version":"< 0.9.1"}]},{"ecosystem":"other","packageName":"kermitt2/grobid","product":"kermitt2/grobid","source":"GitHub GHSA-g2r5-4c8r-c84f","vendor":"","versions":[{"status":"affected","version":"0.9.0","versionType":"GitHub advisory range"}]}],"cveId":"CVE-2026-123356","cwes":["CWE-400"],"description":"GROBID is machine learning software for extracting information from scholarly documents. Prior to 0.9.1, the unauthenticated /api/modelTraining endpoint calls GrobidRestProcessTraining.trainModel in GrobidRestProcessTraining.java, where each request creates Executors.newFixedThreadPool(1), submits a training task, and leaves the executor running. Repeated requests permanently retain JVM worker threads and can exhaust process or operating-system thread capacity, degrading or stopping request processing. This issue is fixed in version 0.9.1.","epss":{"date":"2026-11-09","percentile":0.289,"score":0.0035},"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},{"score":7.5,"severity":"high","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1794266235083,"publishedAt":1793990013986,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/grobidOrg/grobid/security/advisories/GHSA-g2r5-4c8r-c84f"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/grobidOrg/grobid/pull/1477"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/grobidOrg/grobid/commit/3227e9a6a990ec1687173045f119c24e17d10103"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/grobidOrg/grobid/releases/tag/0.9.1"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/grobidOrg/grobid/commit/3227e9a6a990ec1687173045f119c24e17d10103"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/grobidOrg/grobid/pull/1477"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/grobidOrg/grobid/releases/tag/0.9.1"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/grobidOrg/grobid/security/advisories/GHSA-g2r5-4c8r-c84f"},{"source":"GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/grobidOrg/grobid/security/advisories/GHSA-g2r5-4c8r-c84f"}],"remediation":[{"kind":"fix","source":"GitHub GHSA-g2r5-4c8r-c84f","text":"kermitt2/grobid (other): GitHub reports patched versions 0.9.1. Check the advisory for the affected release branch.","url":"https://github.com/grobidOrg/grobid/security/advisories/GHSA-g2r5-4c8r-c84f"}],"revision":"f6a83d385f4cdb72235c433f660f811649f96185b222aff87fab4ac1e85fcebf","sources":[{"modifiedAt":1794264264697,"name":"CNA: GitHub_M","retrievedAt":1794265743193,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123356"},{"modifiedAt":1794266235083,"name":"NVD","retrievedAt":1794269917775,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123356"},{"modifiedAt":1793989977000,"name":"GitHub Security Advisories","retrievedAt":1794144910391,"url":"https://github.com/grobidOrg/grobid/security/advisories/GHSA-g2r5-4c8r-c84f"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794265766745,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-123356"}],"ssvc":{"assessedAt":1794263803349,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"GROBID: Unauthenticated `/api/modelTraining` Endpoint Allows Unbounded Thread Pool Creation (DoS)","updatedAt":1794269917775}