CVE-2025-0453CWE-410

Denial of Service through Batched Queries in GraphQL in mlflow/mlflow

Medium · published March 20, 2025

CVSS v3.0
5.9
EPSS
11%
Percentile
95.9
In the wild
Unconfirmed
What it is

In mlflow/mlflow version 2.17.2, the `/graphql` endpoint is vulnerable to a denial of service attack. An attacker can create large batches of queries that repeatedly request all runs from a given experiment. This can tie up all the workers allocated by MLFlow, rendering the application unable to respond to other requests. This vulnerability is due to uncontrolled resource consumption.

The record
Technical detail
CVSS v3.0
5.9 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.11033 · 95.9th percentile
Weakness
CWE-410 · Insufficient Resource Pool
Published
2025-03-20T10:11Z
EPSS history
Timeline
  • 20 MAR 10:11Z
    Denial of Service through Batched Queries in GraphQL in mlflow/mlflow
    cvelistv5