CVE-2024-8061 Denial of Service in aimhubio/aim

High 7.5 Published 20 Mar 2025 Updated 15 Oct 2025

Attackers can cause denial of service in the AIM tracking server by triggering requests to external servers that lack timeouts, blocking other requests.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-8061?

CVE-2024-8061 is a high-severity denial of service vulnerability in aimhubio/aim, published on 20 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In version 3.23.0 of aimhubio/aim, certain methods that request data from external servers do not have set timeouts, causing the server to wait indefinitely for a response. This can lead to a denial of service, as the tracking server does not respond to other requests while waiting. The issue arises in the client used by the `aim` tracking server to communicate with external resources, specifically in the `_run_read_instructions` method and similar calls without timeouts.

Weakness: CWE-1088

Which versions are affected by CVE-2024-8061?

3 open source packages ship an affected version, including aim. It affects 1 product.

Package	Affected	Fixed in
`aim` PyPI	All versions to `3.23.0`	None
`aim` PyPI	All versions to `3.23.0`	None
`aim` PyPI	All versions to `3.23.0`	None

Products include Aimstack Aim.

How do I fix CVE-2024-8061?

No fix has been published for CVE-2024-8061 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2024-8061 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-8061 exists.

Sources

Also known as GHSA-6w7p-xrvp-p7xv, PYSEC-2026-1083.