CVE-2025-0453: lfprojects mlflow Insufficient Resource Pool

Vulnerability summary

CVE-2025-0453 is a high (CVSS 7.5) Insufficient Resource Pool vulnerability in lfprojects mlflow. EPSS estimates a 11.03% chance of exploitation in the next 30 days, higher than 95.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 20-03-2025
   PublishedVulnerability first disclosed.
2. 15-10-2025
   Last modifiedVulnerability information updated.

Description

In mlflow/mlflow version 2.17.2, the `/graphql` endpoint is vulnerable to a denial of service attack. An attacker can create large batches of queries that repeatedly request all runs from a given experiment. This can tie up all the workers allocated by MLFlow, rendering the application unable to respond to other requests. This vulnerability is due to uncontrolled resource consumption.

• CWE-410Insufficient Resource PoolThe product's resource pool is not large enough to handle peak demand, which allows an attacker to prevent others from accessing the resource by using a (relatively) large number of requests for resources.