PYSEC-2026-1089

vendorUSosv

Aim Uncontrolled Resource Consumption vulnerability

view advisory published 2026-07-07Licence: CC-BY-4.0

In version 3.25.0 of aimhubio/aim, the tracking server is vulnerable to a denial of service attack. The server overrides the maximum size for websocket messages, allowing very large images to be tracked. This causes the server to become unresponsive to other requests while processing the large image, leading to a denial of service condition.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-0189US	high7.5	0.64% (51st)	—	2025-03-20
In version 3.25.0 of aimhubio/aim, the tracking server is vulnerable to a denial of service attack. The server overrides the maximum size for websocket messages, allowing very larg…

references

External citations — patches, advisories, analysis.

https://github.com/advisories/GHSA-j5qj-rg5j-j7c2ADVISORY
https://github.com/aimhubio/aimPACKAGE
https://huntr.com/bounties/e4c9bf41-72cf-4d04-baaf-8f12b5b7926eWEB
https://nvd.nist.gov/vuln/detail/CVE-2025-0189ADVISORY
https://pypi.org/project/aimPACKAGE

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan