CyberRota Analysis
This is a high severity vulnerability with a CVSS score of 7.5. Its EPSS score suggests a 10.4% probability of exploitation in the next 30 days. It may lead to a denial-of-service condition.
CVE
CVE-2025-0453
Severity
HIGH
CVSS
7.5
EPSS
10.41%
Original NVD Description
In mlflow/mlflow version 2.17.2, the `/graphql` endpoint is vulnerable to a denial of service attack. An attacker can create large batches of queries that repeatedly request all runs from a given experiment. This can tie up all the workers allocated by MLFlow, rendering the application unable to respond to other requests. This vulnerability is due to uncontrolled resource consumption.
Related CVEs
Other vulnerabilities affecting the same vendor(s)