HighVulnerability
CVE-2026-123356: GROBID unauthenticated thread exhaustion through /api/modelTraining endpoint
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-123356
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
Summary
GROBID, machine learning software for extracting information from scholarly documents, is affected prior to version 0.9.1. The unauthenticated /api/modelTraining endpoint calls GrobidRestProcessTraining.trainModel in GrobidRestProcessTraining.java, which creates a new fixed thread pool per request and never shuts it down. Repeated requests permanently retain JVM worker threads, which can exhaust thread capacity and degrade or stop request processing.
Mitigation
Fixed in version 0.9.1.
Related items
- MediumCVE-2026-83494: training-operator immutability check bypass in PyTorchJob ValidateUpdate webhookSimilar attack · NVD/CVE Database
- CriticalCVE-2026-48705: MONAI PydicomReader affine computation accepts non-finite DICOM valuesSimilar attack · NVD/CVE Database
- LowCloakFEM: Agentic FEM Code Generation for Red-Teaming Computational Resource ExhaustionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
- MediumThe Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model ResourcesSimilar attack · Google Threat Intelligence
- InfoThe Blind Spots of Detection: Adversarial Perturbation Attacks against Watchdogs in Distributed LLM InferenceSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)