CVE-2025-0453

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In mlflow/mlflow version 2.17.2, the `/graphql` endpoint is vulnerable to a denial of service attack. An attacker can create large batches of queries that repeatedly request all runs from a given experiment. This can tie up all the workers allocated by MLFlow, rendering the application unable to respond to other requests. This vulnerability is due to uncontrolled resource consumption.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-410

Affected software

Vendor	Product	Versions
mlflow	mlflow/mlflow	>= unspecified, <= latest

References

https://huntr.com/bounties/788327ec-714a-4d5c-83aa-8df04dd7612bExploit, Third Party Advisory
https://huntr.com/bounties/788327ec-714a-4d5c-83aa-8df04dd7612bExploit, Third Party Advisory

Timeline

Published: Mar 20, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-04547.5A Server-Side Request Forgery (SSRF) vulnerability was identified in the Requests utility of significant-gravitas/autogpt versions prior to CVE-2025-04559.8The airPASS from NetVision Information has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL CVE-2025-04569.8The airPASS from NetVision Information has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access the s CVE-2025-04578.8The airPASS from NetVision Information has an OS Command Injection vulnerability, allowing remote attackers with regular privileges to injec CVE-2025-04584.3A vulnerability classified as problematic was found in Virtual Computer Vysual RH Solution 2024.12.1. Affected by this vulnerability is an u CVE-2025-04595.3A vulnerability, which was classified as problematic, has been found in libretro RetroArch up to 1.19.1 on Windows. Affected by this issue i CVE-2025-04607.3A vulnerability, which was classified as critical, was found in Blog Botz for Journal Theme 1.0 on OpenCart. This affects an unknown part of CVE-2025-04617.5A vulnerability has been found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.0.0 and classified as problematic. This vu CVE-2025-04629.8A vulnerability was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.0.0 and classified as critical. This issue affe CVE-2025-04639.8A vulnerability was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.0.0. It has been classified as critical. Affect CVE-2025-04644.8A vulnerability was found in SourceCodester Task Reminder System 1.0. It has been declared as problematic. Affected by this vulnerability is CVE-2025-04657.3A vulnerability was found in AquilaCMS 1.412.13. It has been rated as critical. Affected by this issue is some unknown functionality of the