CVE-2025-0453
Lfprojects Mlflow 2.17.2
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2025-0453 is a high-severity Insufficient Resource Pool (CWE-410) vulnerability in Lfprojects Mlflow. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked in the top 5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as Other Platforms; in the Other ATLAS/OWASP Terms risk domain.
The strongest mitigations our analysis identified map to SC-6 (Resource Availability) and AC-10 (Concurrent Session Control) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-0453 is a denial-of-service vulnerability in mlflow/mlflow version 2.17.2, specifically affecting the `/graphql` endpoint. The issue stems from uncontrolled resource consumption (CWE-410), where an attacker can send large batches of queries that repeatedly request all runs from a given experiment. This exhausts all workers allocated by MLflow, preventing the application from responding to other requests.
The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning it is exploitable over the network with low attack complexity, requiring no privileges or user interaction, and results in high availability impact with no effects on confidentiality or integrity. Remote, unauthenticated attackers can trigger the DoS condition, rendering the MLflow service unresponsive.
Mitigation details are available in advisories referenced at https://huntr.com/bounties/788327ec-714a-4d5c-83aa-8df04dd7612b. The vulnerability was published on 2025-03-20.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6836
Vulnerability Data
In mlflow/mlflow version 2.17.2, the `/graphql` endpoint is vulnerable to a denial of service attack. An attacker can create large batches of queries that repeatedly request all runs from a given experiment. This can tie up all the workers allocated…
more
by MLFlow, rendering the application unable to respond to other requests. This vulnerability is due to uncontrolled resource consumption.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Other Platforms
- Risk Domain
- Other ATLAS/OWASP Terms
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: mlflow
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 5 hardening rules · 3 OS baselines
V15.1.3V17.1.2
Mitigating Controls (NIST 800-53 r5) AI
SC-6 directly requires allocation of resources by priority or other means to protect availability against demand spikes.
AC-10 limits concurrent sessions per user, structurally capping how much of the pool any single actor can consume.
SC-5 reduces the impact of resource-exhaustion DoS events without addressing pool sizing itself.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Directly requires maintaining adequate resource capacity to ensure availability, which prevents exhaustion attacks from insufficient pools.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Capacity management directly addresses sizing resource pools to handle peak demand and prevent exhaustion.
Redundancy of processing facilities mitigates resource exhaustion by providing failover capacity.
Secure architecture principles include designing adequate resource allocation and limits.
Security testing can detect insufficient resource pools before deployment.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (1 rule)
- V-248553 OL 8 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive. prevents CWE-410
Oracle Linux 9 (2 rules)
- V-271709 OL 9 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive. prevents CWE-410
- V-271710 OL 9 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive. prevents CWE-410
RHEL 8 (2 rules)
- V-230244 RHEL 8 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive. prevents CWE-410
- V-244525 RHEL 8 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive. prevents CWE-410