Denial of Service in aimhubio/aim

Vulnerability

Overview

CVE-2024-12778 is a denial of service (DoS) vulnerability in aimhubio/aim version 3.25.0, an open-source ML experiment tracker [1]. The root cause is the absence of a limit on the number of tracked metrics that can be requested in a single API call; combined with the web server's single-threaded architecture, this leads to excessive resource consumption that blocks the server from processing further requests [2].

Exploitation and

Impact

An unauthenticated attacker can exploit this by sending a request to retrieve a large number of metrics simultaneously from the Aim web API. Because the server processes the request in a single thread, the operation monopolizes CPU and memory resources, making the web interface and API completely unresponsive until the request completes or the server is manually restarted [2]. There is no requirement for authentication, and the attack can be carried out remotely over HTTP.

Mitigation

As of the publication date (2025-03-20), no patch has been released for version 3.25.0. The vendor's GitHub repository and the Huntr bounty disclosure both describe the issue, but no official fix or workaround is documented [1][3]. Administrators should monitor the aimhubio/aim repository for updates and consider implementing a reverse proxy with request size limits or resource throttling as a temporary measure.