CVE-2025-0453
CVSS 3.1 Score 7.5 of 10 (high)
Details
Published Mar 20, 2025
Updated: Apr 2, 2025
CWE ID 400
Summary
CVE-2025-0453 is a denial-of-service vulnerability affecting mlflow version 2.17.2. The issue lies in the `/graphql` endpoint, which can be abused by an attacker to submit large batches of queries requesting all runs from a specific experiment. These queries consume excessive resources, causing all workers allocated by MLFlow to become unresponsive and preventing the application from handling other requests. Overall, this vulnerability results in a denial of service due to uncontrolled resource consumption.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Vendors
- LF Projects, LLC