Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai
CVE-2024-8061Denial of Service in aimhubio/aim
High 7.5
In plain English
A high-severity security flaw in aimhubio/aim from aimhubio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Official description
In version 3.23.0 of aimhubio/aim, certain methods that request data from external servers do not have set timeouts, causing the server to wait indefinitely for a response. This can lead to a denial of service, as the tracking server does not respond to other requests while waiting. The issue arises in the client used by the `aim` tracking server to communicate with external resources, specifically in the `_run_read_instructions` method and similar calls without timeouts.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | aim | no fix listed | GHSA-6w7p-xrvp-p7xv |
| PyPI | aim | no fix listed | PYSEC-2026-1083 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| aimhubio | aimhubio/aim | unspecified – through latest |
Weakness: CWE-1088 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H