Executive brief
Aim is an open-source experiment tracking platform used by machine learning teams to monitor and compare model training runs. A vulnerability in its web API allows attackers to request an unlimited number of metrics simultaneously, overwhelming the single-threaded server and causing a denial of service where legitimate users cannot access their tracking data.
Technical details
The vulnerability is an uncontrolled resource consumption issue (CWE-400, CWE-770) in Aim's web API metrics endpoint. The root cause is the lack of rate limiting or pagination limits on metric retrieval requests combined with the server's single-threaded architecture. An unauthenticated network attacker can send a request to retrieve a large number of metrics in a single API call, causing excessive memory allocation and CPU usage that blocks the server from processing other requests. The vulnerability affects all versions up to and including 3.25.0, with no patch information currently available in the advisory.
Affected products
- aimhubio Aim up to 3.25.0
Timeline
- 2025-03-20: disclosed: Advisory published on OSV
- 2025-03-20: advisory: CVE-2024-12778 and GHSA-35p3-6j45-prwm assigned