Kurz gesagt
- CVE-2025-0190 ist eine Schwachstelle (HOCH (CVSS 7.5)) in aim, aim (aimstack).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.64%, höher als bei 50.6% aller Schwachstellen.
- Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.
| Package | Affected versions | Patched versions |
|---|
| aim PyPI | ≤ 3.25.0
| No fix yet |
| aim | = 3.25.0
| No fix yet |
Description
In version 3.25.0 of aimhubio/aim, a denial of service vulnerability exists. By tracking a large number of Text objects and then querying them simultaneously through the web API, the Aim web server becomes unresponsive to other requests for an extended period while processing and returning these objects. This vulnerability can be exploited repeatedly, leading to a complete denial of service.
NVD description
In version 3.25.0 of aimhubio/aim, a denial of service vulnerability exists. By tracking a large number of `Text` objects and then querying them simultaneously through the web API, the Aim web server becomes unresponsive to other requests for an extended period while processing and returning these objects. This vulnerability can be exploited repeatedly, leading to a complete denial of service.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free