Denial of Service Vulnerability in MLflow by Databricks

CVE-2024-6838

Summary

In MLflow version v2.13.2, a vulnerability has been identified that allows users to create or rename experiments with excessively large names. The absence of restrictions on the character count for experiment names can lead to unresponsive behavior in the MLflow UI, potentially resulting in denial of service. Furthermore, the artifact_location parameter lacks a character limit during experiment creation, exacerbating the issue and impacting application functionality.

References