CVE-2025-0453: MLflow Uncontrolled Resource Consumption vulnerability

The vulnerability stems from the /graphql endpoint's handling of experiment run queries. GraphQL resolvers like resolve_runs would be responsible for fetching experiment runs. The advisory indicates attackers exploit this by repeatedly requesting all runs, which implies the resolver lacks safeguards like query cost analysis, maximum result limits, or rate-limiting. This matches the CWE-400 pattern where resource consumption isn't controlled. The handler file is the logical location for GraphQL resolver implementations in MLflow's architecture.