Denial of Service in aimhubio/aim

In version 3.25.0 of aimhubio/aim, a denial of service vulnerability exists due to inefficient handling of large numbers of Text objects. When these objects are tracked and subsequently queried through the web API, the server processes them synchronously, causing prolonged unresponsiveness to other requests [2].

An attacker can exploit this by tracking a large number of Text objects and then sending simultaneous queries via the web API. No authentication or special privileges are required beyond normal API access, making the attack accessible to any user of the Aim instance [3]. Each query triggers extensive processing, and repeated exploitation can lock the server indefinitely.

The impact is a complete denial of service, as the web server becomes unable to respond to legitimate requests for an extended period. This can disrupt experiment tracking and data analysis workflows for other users [2].

As of the disclosure, no official patch has been announced. Users are advised to upgrade to a patched version if available, or implement rate limiting and restrict API query sizes to mitigate the risk [3].