CVE-2024-6838: MLflow Experiment Name DOS Vulnerability

CVE-2024-6838 Overview

CVE-2024-6838 affects mlflow/mlflow version 2.13.2, an open-source machine learning lifecycle platform maintained by the Linux Foundation AI & Data (LF Projects). The vulnerability allows an attacker to create or rename an experiment using an unbounded number of integer characters in its name. The absence of a length limit causes the MLflow user interface to become unresponsive, producing a denial of service condition. A related weakness affects the artifact_location parameter, which similarly lacks a character limit during experiment creation. The flaw is classified under [CWE-400: Uncontrolled Resource Consumption].

Critical Impact
A remote, unauthenticated attacker can render the MLflow UI unresponsive by supplying experiment names or artifact locations of excessive length, disrupting availability for legitimate users.

Affected Products

mlflow/mlflow version 2.13.2
Deployments exposing the MLflow tracking server UI
Environments accepting experiment creation or rename API calls

Discovery Timeline

2025-03-20 - CVE-2024-6838 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6838

Vulnerability Analysis

MLflow exposes REST endpoints and a web UI for managing machine learning experiments. The tracking server accepts experiment creation and rename requests without validating the length of user-supplied fields. When an experiment name contains an excessive number of integer characters, the UI attempts to render the value and becomes unresponsive. The artifact_location parameter shares the same missing validation on experiment creation.

The issue is a resource consumption weakness rather than a memory safety flaw. The server accepts input, stores it, and later the UI struggles to process the oversized value during rendering operations. Because the flaw impacts availability of a shared MLflow instance, any user or automated pipeline relying on the UI is affected until the offending experiment is removed.

Root Cause

The root cause is the absence of server-side length validation on the experiment name field and the artifact_location field in the experiment creation and rename APIs. MLflow accepts arbitrarily long strings and persists them, deferring any practical limits to the browser rendering layer. When the UI attempts to display the oversized values, it consumes excessive client resources and stalls.

Attack Vector

Exploitation requires network access to the MLflow tracking server. An attacker submits a crafted request to the create-experiment or rename-experiment endpoint containing an experiment name consisting of a very large sequence of integers. Alternatively, the attacker supplies an oversized artifact_location during creation. No authentication is required in default deployments, and no user interaction is needed beyond an analyst subsequently opening the affected experiment in the UI.

See the Huntr Bounty Listing for the disclosure details. No public exploit code has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-6838

Indicators of Compromise

Experiments in the MLflow metadata store containing names composed of unusually long numeric strings.
Experiment records with artifact_location values exceeding expected path lengths for the environment.
User reports of the MLflow UI hanging or timing out when listing or opening experiments.

Detection Strategies

Query the MLflow backend store for experiment name and artifact_location fields exceeding a reasonable threshold, such as 250 characters.
Inspect tracking server access logs for POST requests to /api/2.0/mlflow/experiments/create and /api/2.0/mlflow/experiments/update containing oversized payloads.
Alert on HTTP request bodies to MLflow endpoints that exceed a defined size baseline for experiment management traffic.

Monitoring Recommendations

Monitor MLflow tracking server CPU, memory, and response latency for sustained anomalies coinciding with experiment operations.
Capture web application firewall (WAF) telemetry for requests to MLflow experiment endpoints and forward to a centralized log platform for retention and correlation.
Track user-reported UI availability issues in ticketing systems and correlate with recent experiment creations or renames.

How to Mitigate CVE-2024-6838

Immediate Actions Required

Upgrade MLflow to a version later than 2.13.2 that enforces length limits on experiment name and artifact_location fields.
Restrict network access to the MLflow tracking server to trusted users and pipelines using network segmentation or a reverse proxy with authentication.
Audit existing experiments and remove or rename any records with abnormally long names or artifact locations.

Patch Information

No vendor advisory URL is listed in the enriched CVE data. Consult the upstream mlflow/mlflow project release notes and the Huntr Bounty Listing for remediation guidance and to identify the fixed release.

Workarounds

Place MLflow behind a reverse proxy such as NGINX or Envoy and enforce request body size limits and per-field length restrictions.
Require authentication for all MLflow endpoints to prevent unauthenticated experiment creation or renaming.
Implement application-layer input validation in any wrapper or SDK used to create experiments, rejecting names or artifact locations above a defined length.

bash

# Configuration example: NGINX reverse proxy limiting request size to MLflow
server {
    listen 443 ssl;
    server_name mlflow.internal.example.com;

    client_max_body_size 64k;
    client_body_buffer_size 16k;

    location /api/2.0/mlflow/experiments/ {
        limit_except GET POST { deny all; }
        proxy_pass http://mlflow_upstream;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}