CVE-2024-10110: Aim Vulnerable to Denial of Service (DoS)

March 20, 2025

In version 3.23.0 of aimhubio/aim, the ScheduledStatusReporter object can be instantiated to run on the main thread of the tracking server, leading to the main thread being blocked indefinitely. This results in a denial of service as the tracking server becomes unable to respond to other requests.

References

github.com/advisories/GHSA-fx47-jpv9-7hxr
github.com/aimhubio/aim
github.com/aimhubio/aim/blob/a566d4a2501c96a545a3c89d92af6ad7e7e0da99/aim/sdk/reporter/__init__.py
huntr.com/bounties/5ea6cf56-7b4c-4dce-9b6c-3e910fbb1ae4
nvd.nist.gov/vuln/detail/CVE-2024-10110

Code Behaviors & Features

Detect and mitigate CVE-2024-10110 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →