GROBID model training API creates unbounded threads, enabling denial of service
Anyone can send repeated requests and freeze the document processing server.
Summary
The unauthenticated /api/modelTraining endpoint in GROBID creates a thread pool per request and never shuts it down, so repeated requests can slow or stop the server. Versions before 0.9.1 are affected.
Affected when
- /api/modelTraining endpoint reachable without authentication
What to do
Update to version 0.9.1 or later. If you cannot confirm the version, read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen