CVE-2025-0190 HIGH

CVE-2025-0190: Denial of Service in aimhubio/aim

Vendor Aimhubio
Product aimhubio/aim
Weakness CWE-1049
Published March 20, 2025
Last update March 20, 2025
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

In version 3.25.0 of aimhubio/aim, a denial of service vulnerability exists. By tracking a large number of `Text` objects and then querying them simultaneously through the web API, the Aim web server becomes unresponsive to other requests for an extended period while processing and returning these objects. This vulnerability can be exploited repeatedly, leading to a complete denial of service.

Key dates

02Disclosure timeline

March 20, 2025 CVE published
March 20, 2025 Record updated