AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

MLflowGHSA-49m6-vrr9-2cqm

MLflow Uncontrolled Resource Consumption vulnerability

MLflow

CVE-2025-0453 · Published Mar 20, 2025 · updated Jul 7, 2026

Medium5.9
No fix yet
GitHub advisory

In mlflow/mlflow version 2.17.2, the /graphql endpoint is vulnerable to a denial of service attack. An attacker can create large batches of queries that repeatedly request all runs from a given experiment. This can tie up all the workers allocated by MLFlow, rendering the application unable to respond to other requests. This vulnerability is due to uncontrolled resource consumption.

Affected versions

PackageAffectedFixed in
mlflow
PyPI
<= 2.17.2No fix yet
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-400, CWE-410
Also known as
BIT-mlflow-2025-0453, CVE-2025-0453, PYSEC-2026-1637

More MLflow advisories

All MLflow