VULNERABILITY INTELLIGENCE

CVE-2025-0453

CVSS score7.5 HIGH
EPSS probability11.31%
CISA KEVNot currently listed
Published2025-03-20
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

In mlflow/mlflow version 2.17.2, the `/graphql` endpoint is vulnerable to a denial of service attack. An attacker can create large batches of queries that repeatedly request all runs from a given experiment. This can tie up all the workers allocated by MLFlow, rendering the application unable to respond to other requests. This vulnerability is due to uncontrolled resource consumption.

Weakness classification

  • security@huntr.dev: CWE-410
  • nvd@nist.gov: NVD-CWE-noinfo

Primary references