Vulnerability · Published Jul 8, 2024 · Assigned by @huntr_ai
CVE-2024-6227Infinite Loop in aimhubio/aim
High 7.5
In plain English
A high-severity infinite loop in aimhubio/aim from aimhubio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 52.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to cause an infinite loop by configuring the remote tracking server to point at itself. This results in the server endlessly connecting to itself, rendering it unable to respond to other connections.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | aim | no fix listed | GHSA-36h2-g4c8-9xcm |
| PyPI | aim | no fix listed | PYSEC-2026-1081 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| aimhubio | aimhubio/aim | unspecified – through latest |
Weakness: CWE-835 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H