CVE-2026-123356

GROBID model training can exhaust worker capacity

GROBID · GROBID model training

First documented disclosure · Review checkpoint

Summary

Unauthenticated training requests can exhaust worker capacity.

Severity and exploitation evidence

High · 7.5/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public sources describe the vulnerability and its conditions. Malicious exploitation has not been established in the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Training requests create worker pools whose threads can remain allocated after the request ends.

Conditions required

The model-training interface must be reachable. The affected endpoint does not require a login.

Potential impact

The service can exhaust available threads and stop processing documents.

Affected versions and configurations

The CNA lists versions before 0.9.1. The maintainer advisory identifies 0.9.0.

Fix and mitigation status

0.9.1.

Practical next steps

Upgrade to 0.9.1 and restrict access to training services.

Operating lesson

Bound training concurrency and release per-request resources.

Evidence and limits

The dated public project record and the later CVE describe the same affected component. The fixed version is identified by the project or assigning authority.

Sources