CVE-2024-12778: Aim Uncontrolled Resource Consumption vulnerability

March 20, 2025 (updated March 21, 2025)

A vulnerability in aimhubio/aim version 3.25.0 allows for a denial of service (DoS) attack. The issue arises when a large number of tracked metrics are retrieved simultaneously from the Aim web API, causing the web server to become unresponsive. The root cause is the lack of a limit on the number of metrics that can be requested per call, combined with the server’s single-threaded nature, leading to excessive resource consumption and blocking of the server.

References

github.com/advisories/GHSA-35p3-6j45-prwm
github.com/aimhubio/aim
huntr.com/bounties/892a9eee-0251-4e57-94a4-dad2e7f32715
nvd.nist.gov/vuln/detail/CVE-2024-12778

Code Behaviors & Features

Detect and mitigate CVE-2024-12778 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →