CVE-2025-0190: Aim Package Denial of Service Vulnerability Due to Excessive Data Query Operations
Summary
CVE-2025-0190: Aim Excessive Data Query Operations in a Large Data Table vulnerability. Affects aim versions < 3.25.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Aim package, available on PyPI, is designed for tracking and managing data through its web API. It allows users to create and manipulate 'Text' objects, making it a powerful tool for data-driven applications. However, its functionality can be compromised due to a vulnerability that leads to denial of service when handling large datasets.
Vulnerability Detail
In version 3.25.0 of the Aim package, a denial of service vulnerability exists. This issue arises when a large number of 'Text' objects are tracked and queried simultaneously through the web API. The Aim web server becomes unresponsive to other requests for an extended period while it processes and returns these objects. This vulnerability can be exploited repeatedly, resulting in a complete denial of service, which can severely impact application performance and availability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, limit the number of simultaneous queries made to the Aim web API. Implementing rate limiting on the client side can help prevent overwhelming the server with excessive requests.
Conclusion
The Aim package has a significant denial of service vulnerability (CVE-2025-0190) that can be exploited by making excessive data queries. It is crucial for users to update to a patched version to mitigate this risk and ensure the stability of their applications.
See every vulnerability recorded for aim →
FAQ
CVE-2025-0190 is a vulnerability in the Aim package that can lead to denial of service due to excessive data query operations.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploiting this vulnerability can lead to the Aim web server becoming unresponsive, affecting the availability and performance of applications relying on it.
Yes, updating to a version later than 3.25.0 of the Aim package will resolve this vulnerability.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for aim.
