{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-123356","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","state":"PUBLISHED","assignerShortName":"GitHub_M","dateReserved":"2026-11-05T20:43:10.419Z","datePublished":"2026-11-06T18:33:33.986Z","dateUpdated":"2026-11-06T18:33:33.986Z"},"containers":{"cna":{"title":"GROBID: Unauthenticated `/api/modelTraining` Endpoint Allows Unbounded Thread Pool Creation (DoS)","problemTypes":[{"descriptions":[{"cweId":"CWE-400","lang":"en","description":"CWE-400: Uncontrolled Resource Consumption","type":"CWE"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}}],"references":[{"name":"https://github.com/grobidOrg/grobid/security/advisories/GHSA-g2r5-4c8r-c84f","tags":["x_refsource_CONFIRM"],"url":"https://github.com/grobidOrg/grobid/security/advisories/GHSA-g2r5-4c8r-c84f"},{"name":"https://github.com/grobidOrg/grobid/pull/1477","tags":["x_refsource_MISC"],"url":"https://github.com/grobidOrg/grobid/pull/1477"},{"name":"https://github.com/grobidOrg/grobid/commit/3227e9a6a990ec1687173045f119c24e17d10103","tags":["x_refsource_MISC"],"url":"https://github.com/grobidOrg/grobid/commit/3227e9a6a990ec1687173045f119c24e17d10103"},{"name":"https://github.com/grobidOrg/grobid/releases/tag/0.9.1","tags":["x_refsource_MISC"],"url":"https://github.com/grobidOrg/grobid/releases/tag/0.9.1"}],"affected":[{"vendor":"grobidOrg","product":"grobid","versions":[{"version":"< 0.9.1","status":"affected"}]}],"providerMetadata":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-11-06T18:33:33.986Z"},"descriptions":[{"lang":"en","value":"GROBID is machine learning software for extracting information from scholarly documents. Prior to 0.9.1, the unauthenticated /api/modelTraining endpoint calls GrobidRestProcessTraining.trainModel in GrobidRestProcessTraining.java, where each request creates Executors.newFixedThreadPool(1), submits a training task, and leaves the executor running. Repeated requests permanently retain JVM worker threads and can exhaust process or operating-system thread capacity, degrading or stopping request processing. This issue is fixed in version 0.9.1."}],"source":{"advisory":"GHSA-g2r5-4c8r-c84f","discovery":"UNKNOWN"}}}}