GitHub Advisoryadvisory · PyPI

GHSA-6w7p-xrvp-p7xv Aim allows denial of service due to no timeouts for some tracking server endpoints

HIGH Published 2025-03-20 Modified 2025-10-15 Official page ↗
Aliases
CVE-2024-8061
Ecosystem
PyPI
Packages
aim
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1088, CWE-400
Reviewed
2025-03-21

Affected packages

• PyPI aim: <= 3.23.0 (no fix yet)

Description

In version 3.23.0 of aimhubio/aim, certain methods that request data from external servers do not have set timeouts, causing the server to wait indefinitely for a response. This can lead to a denial of service, as the tracking server does not respond to other requests while waiting. The issue arises in the client used by the `aim` tracking server to communicate with external resources, specifically in the `_run_read_instructions` method and similar calls without timeouts.

Related

Alias · CVE (1)

  • CVE-2024-8061 In version 3.23.0 of aimhubio/aim, certain methods that request data from external servers do not have set timeouts, causing the server to… vulnerability

Weakness · CWE (2)

  • CWE-1088 Synchronous Access of Remote Resource without Timeout weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References