An unauthenticated /api/modelTraining endpoint in GROBID creates a new single‑thread executor with each request, leaving it running. Repeated requests accumulate worker threads, eventually exhausting JVM or operating‑system thread capacity and causing request processing to degrade or stop. The weakness is a resource‑exhaustion flaw (CWE‑400).

Vendor GROBID, product GROBID, versions earlier than 0.9.1 are affected. The vulnerability was fixed in release 0.9.1 and subsequent versions. All deployments running a prior version are vulnerable.

The CVSS score of 7.5 indicates a high‑severity impact. EPSS is not available, but the vulnerability is publicly exploitable due to the unauthenticated nature of the endpoint. An attacker can trigger unlimited thread creation via web traffic, exhausting capacity and resulting in denial of service. The vulnerability is not listed in the CISA KEV catalogue, so no known active exploits exist, but the high score and lack of rate limiting make the risk significant.