{"id":"CVE-2024-6838","aliases":["GHSA-q3gw-8236-5jw4","BIT-mlflow-2024-6838","PYSEC-2026-1658"],"title":"MLflow Uncontrolled Resource Consumption vulnerability","summary":"MLflow Uncontrolled Resource Consumption vulnerability","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","vendor":"mlflow","product":"mlflow","ecosystem":"pip","affected":["mlflow <= 2.13.2"],"published":"2025-03-20","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-q3gw-8236-5jw4","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6838"},{"url":"https://github.com/mlflow/mlflow"},{"url":"https://huntr.com/bounties/8ad52cb2-2cda-4eb0-aec9-586060ee43e0"}],"tags":["osv","pip"],"epss":0.00652,"epssPercentile":0.49845,"ingestedAt":"2026-07-08T18:25:52.077Z","slug":"CVE-2024-6838","body":"## Overview\n\nIn mlflow/mlflow version v2.13.2, a vulnerability exists that allows the creation or renaming of an experiment with a large number of integers in its name due to the lack of a limit on the experiment name. This can cause the MLflow UI panel to become unresponsive, leading to a potential denial of service. Additionally, there is no character limit in the `artifact_location` parameter while creating the experiment.\n\n## Affected packages\n\n- `mlflow <= 2.13.2`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}