CVE-2025-0189 Denial of Service in aimhubio/aim
An attacker can cause a denial of service by sending large images to the AIM tracking server, which overrides websocket message size limits.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-0189?
CVE-2025-0189 is a high-severity denial of service vulnerability in aimhubio/aim, published on 20 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In version 3.25.0 of aimhubio/aim, the tracking server is vulnerable to a denial of service attack. The server overrides the maximum size for websocket messages, allowing very large images to be tracked. This causes the server to become unresponsive to other requests while processing the large image, leading to a denial of service condition.
Weakness: CWE-770
Which versions are affected by CVE-2025-0189?
3 open source packages ship an affected version, including aim. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
aim PyPI | All versions to 3.25.0 | None |
aim PyPI | All versions to 3.25.0 | None |
aim PyPI | All versions to 3.25.0 | None |
Products include Aimstack Aim.
How do I fix CVE-2025-0189?
No fix has been published for CVE-2025-0189 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-0189 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-0189 exists.
Other vulnerabilities in aimhubio/aim
- CVE-2024-6396 Arbitrary File Overwrite and Data Exfiltration in aimhubio/aim
- CVE-2024-2195 Remote Code Execution in aimhubio/aim
- CVE-2024-6829 Arbitrary File Overwrite through tarfile-extraction in aimhubio/aim
- CVE-2024-8769 Arbitrary File Deletion via Relative Path Traversal in aimhubio/aim
- CVE-2025-51464 Aim vulnerable to Cross-site Scripting
Sources
Also known as GHSA-j5qj-rg5j-j7c2, PYSEC-2026-1089.