CVE-2024-6838 - CVE House
Back to Database
Status published Medium CVE-2024-6838

Uncontrolled Resource Consumption in mlflow/mlflow

Vulnerability Description

In mlflow/mlflow version v2.13.2, a vulnerability exists that allows the creation or renaming of an experiment with a large number of integers in its name due to the lack of a limit on the experiment name. This can cause the MLflow UI panel to become unresponsive, leading to a potential denial of service. Additionally, there is no character limit in the `artifact_location` parameter while creating the experiment.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-6838

Credits & Attribution

No credits recorded in the NVD database.

References

More from mlflow

View All →
CVE-2025-1474
Weak Password Requirements in mlflow/mlflow
Low 3.8
CVE-2025-1473
CSRF in mlflow/mlflow
Medium 5.4
CVE-2025-15381
Unauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflow
High 8.1
CVE-2025-15379
Command Injection in mlflow/mlflow
Critical 10
CVE-2025-15036
Path Traversal Vulnerability in mlflow/mlflow
Critical 9.6

Affected Vendor

Affected Software

mlflow/mlflow
Vulnerable Versions:
unspecified

Timeline

Official Publish: March 20th, 2025
Last Modified: March 20th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weaknesses (CWE)

CWE-400

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact