GHSA-fm93-g6xp-35xq

Aim Excessive Data Query Operations in a Large Data Table vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2025-0190

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	aim	<= 3.25.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

In version 3.25.0 of aimhubio/aim, a denial of service vulnerability exists. By tracking a large number of `Text` objects and then querying them simultaneously through the web API, the Aim web server becomes unresponsive to other requests for an extended period while processing and returning these objects. This vulnerability can be exploited repeatedly, leading to a complete denial of service.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-0190 advisory
https://github.com/aimhubio/aim package
https://huntr.com/bounties/38d151f1-abb4-443a-86b0-6c26f0c6cb70 web