We use cookies to improve your experience on our site.
AVID-2026-R1609
Description
Denial of Service in aimhubio/aim (CVE-2024-8061)
Details
In version 3.23.0 of aimhubio/aim, certain methods that request data from external servers do not have set timeouts, causing the server to wait indefinitely for a response. This can lead to a denial of service, as the tracking server does not respond to other requests while waiting. The issue arises in the client used by the aim tracking server to communicate with external resources, specifically in the _run_read_instructions method and similar calls without timeouts.
Reason for inclusion in AVID: CVE-2024-8061 describes a Denial of Service due to missing timeouts in the aimhubio/aim client used by the Aim experiment tracking server. This impacts software commonly used in ML/AI pipelines for tracking experiments, constitutes a security vulnerability with network-based DoS, and affects a component (tracking/experiment tooling) that can be part of the software stack powering general-purpose AI systems. Sufficient evidence is provided (CVE details, CWE-1088, CVSS, references).
References
Affected or Relevant Artifacts
- Developer: aimhubio
- Deployer: aimhubio
- Artifact Details:
| Type | Name |
|---|---|
| System | aimhubio/aim |
Impact
AVID Taxonomy Categorization
- Risk domains: Security
- SEP subcategories: S0100: Software Vulnerability
- Lifecycle stages: L06: Deployment
CVSS
| Version | 3.0 |
| Vector String | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| Base Score | 7.5 |
| Base Severity | 🔴 High |
| Attack Vector | NETWORK |
| Attack Complexity | 🟢 Low |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | 🔴 High |
CWE
| ID | Description |
|---|---|
| CWE-1088 | CWE-1088 Synchronous Access of Remote Resource without Timeout |
Other information
- Report Type: Advisory
- Credits:
- Date Reported: 2025-03-20
- Version: 0.3.3
- AVID Entry