PT-2025-12167 · Mlflow · Mlflow

Published 2025-03-20 · Updated 2025-04-02 · CVE-2024-6838

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions mlflow/mlflow version v2.13.2

Description A potential denial of service issue exists due to the lack of a limit on the experiment name, allowing the creation or renaming of an experiment with a large number of integers in its name. This can cause the MLflow UI panel to become unresponsive. Additionally, there is no character limit in the artifact location parameter while creating the experiment.

Recommendations For mlflow/mlflow version v2.13.2, consider implementing a character limit for experiment names and the artifact location parameter to prevent potential denial of service attacks. As a temporary workaround, restrict the creation or renaming of experiments with excessively long names to minimize the risk of exploitation.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BIT-MLFLOW-2024-6838

CVE-2024-6838

GHSA-Q3GW-8236-5JW4

Affected Products

Mlflow

References · 7

• 🔥 https://huntr.com/bounties/8ad52cb2-2cda-4eb0-aec9-586060ee43e0 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-6838 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6838 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mlflow-2024-6838 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q3gw-8236-5jw4 · Vendor Advisory
• https://github.com/mlflow/mlflow · Note
• https://twitter.com/CVEnew/status/1903027705752216002 · Twitter Post