CVE-2025-0190: Aim Package Denial of Service Vulnerability Due to Excessive Data Query Operations
Summary
CVE-2025-0190: Aim Excessive Data Query Operations in a Large Data Table vulnerability. Affects aim versions < 3.25.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Aim is an open-source package available on PyPI that facilitates the management and tracking of machine learning experiments. It allows users to log, visualize, and analyze their experiments efficiently. However, version 3.25.0 of Aim has a vulnerability that can lead to a denial of service, making it crucial for users to be aware of this issue.
Vulnerability Detail
In version 3.25.0 of aimhubio/aim, a denial of service vulnerability exists. By tracking a large number of 'Text' objects and querying them simultaneously through the web API, the Aim web server becomes unresponsive to other requests for an extended period while processing and returning these objects. This vulnerability can be exploited repeatedly, leading to a complete denial of service, which can severely impact users relying on the Aim web server for their machine learning workflows.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can limit the number of simultaneous queries made to the Aim web server. This can be done by implementing a queue system in your application that manages the requests to the API, ensuring that only a limited number of queries are processed at a time.
Conclusion
The denial of service vulnerability in version 3.25.0 of the Aim package poses a significant risk to users. It is essential to update to the latest version to mitigate this risk and ensure the smooth operation of machine learning workflows. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for aim →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential impacts include the Aim web server becoming unresponsive, leading to a denial of service for users relying on it for their machine learning tasks.
Yes, a patched version of the Aim package is available. Users should update to the latest version to mitigate the risk.
If you cannot update the package immediately, consider implementing a request queue to limit the number of simultaneous queries to the Aim web server.
Related vulnerabilities
Recent vulnerabilities recorded for aim.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
