CVE-2025-0190
Denial of Service in aimhubio/aim
- State
- Published
- Severity
- 7.5 High
- Published
- Mar 20, 2025
- Updated
- Mar 20, 2025
- Reserved
- Jan 3, 2025
Description
In version 3.25.0 of aimhubio/aim, a denial of service vulnerability exists. By tracking a large number of `Text` objects and then querying them simultaneously through the web API, the Aim web server becomes unresponsive to other requests for an extended period while processing and returning these objects. This vulnerability can be exploited repeatedly, leading to a complete denial of service.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 7.5 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | @huntr_ai |
Weaknesses
- CWE-1049 Excessive Data Query Operations in a Large Data Table
Affected Products
| Product | Versions |
|---|---|
aimhubio/aimaimhubio |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.