CVE-2025-0453
In mlflow/mlflow version 2.17.2, the `/graphql` endpoint is vulnerable to a denial of service attack. An attacker can create large batches of queries that repeatedly request all runs from a given experiment. This can tie up all the workers allocated by MLFlow, rendering the application unable to respond to other requests. This vulnerability is due to uncontrolled resource consumption.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.9
- CVSS vector
- CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS probability
- 10.95%
- CWE
- CWE-410
- Published
- 2025-03-20
- Last modified
- 2026-03-13
Affected products
- mlflow mlflow/mlflow
Weakness type
Related vulnerabilities
- CVE-2026-58218 — Samba: dns signing dos via tkey name cache exhaustion
- CVE-2026-34019 — BIG-IP BFD vulnerability
- CVE-2025-2134 — IBM Jazz Reporting Service Denial of Service
- CVE-2025-12986 — Denial of Service Vulnerability in Silicon Labs WF200 and WGM160P Devices
- CVE-2025-41653 — Weidmueller: Denial-of-Service Vulnerability in the web server functionality of Industrial Ethernet Switches
- CVE-2025-20103 — Insufficient resource pool in the core management mechanism for some Intel(R) Processors may allow...
- CVE-2025-27479 — Kerberos Key Distribution Proxy Service Denial of Service Vulnerability
- CVE-2025-27694 — Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Insufficient Resource Pool...