grobidOrg Grobid up to 0.9.0 Training Endpoint GrobidRestProcessTraining.java GrobidRestProcessTraining.trainModel resource consumption

Summaryinfo

A vulnerability described as problematic has been identified in grobidOrg Grobid up to 0.9.0. Affected by this vulnerability is the function GrobidRestProcessTraining.trainModel of the file GrobidRestProcessTraining.java of the component Training Endpoint. Such manipulation leads to resource consumption. This vulnerability is referenced as CVE-2026-123356. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in grobidOrg Grobid up to 0.9.0. It has been rated as problematic. Affected by this issue is the function GrobidRestProcessTraining.trainModel of the file GrobidRestProcessTraining.java of the component Training Endpoint. The manipulation with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource. Impacted is availability. CVE summarizes:

GROBID is machine learning software for extracting information from scholarly documents. Prior to 0.9.1, the unauthenticated /api/modelTraining endpoint calls GrobidRestProcessTraining.trainModel in GrobidRestProcessTraining.java, where each request creates Executors.newFixedThreadPool(1), submits a training task, and leaves the executor running. Repeated requests permanently retain JVM worker threads and can exhaust process or operating-system thread capacity, degrading or stopping request processing. This issue is fixed in version 0.9.1.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-123356 since 11/05/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 0.9.1 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• grobidOrg

Name

• Grobid

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9.0

Website

• Product: https://github.com/grobidOrg/grobid/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion