Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai
CVE-2025-0189Denial of Service in aimhubio/aim
High 7.5
In plain English
A high-severity resource allocation without limits in aimhubio/aim from aimhubio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).
Severity (CVSS 3.0)7.5High
Exploit odds (30 days)0.6%top 48.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
In version 3.25.0 of aimhubio/aim, the tracking server is vulnerable to a denial of service attack. The server overrides the maximum size for websocket messages, allowing very large images to be tracked. This causes the server to become unresponsive to other requests while processing the large image, leading to a denial of service condition.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | aim | no fix listed | GHSA-j5qj-rg5j-j7c2 |
| PyPI | aim | no fix listed | PYSEC-2026-1089 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| aimhubio | aimhubio/aim | unspecified – through latest |
Weakness: CWE-770 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H