CVE-2024-8061: aim — Exploit

Description

In version 3.23.0 of aimhubio/aim, certain methods that request data from external servers do not have set timeouts, causing the server to wait indefinitely for a response. This can lead to a denial of service, as the tracking server does not respond to other requests while waiting. The issue arises in the client used by the `aim` tracking server to communicate with external resources, specifically in the `_run_read_instructions` method and similar calls without timeouts.

Is your site exposed to CVE-2024-8061?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.5

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness Type (CWE)

CWE-1088 CWE-1088

Affected Products

Vendor	Product	Versions
aimstack	aim	All

References

Exploits

https://huntr.com/bounties/c85d005c-b354-4c51-a88f-adda2f09622b

Frequently Asked Questions

What is CVE-2024-8061? +

In version 3.23.0 of aimhubio/aim, certain methods that request data from external servers do not have set timeouts, causing the server to wait indefinitely for a response. This can lead to a denial of service, as the tracking server does not respond to other requests while waiting. The issue arises in the client used by the `aim` tracking server to communicate with external resources, specifically in the `_run_read_instructions` method and similar calls without timeouts. It has a CVSS v3.1 base score of 7.5 (HIGH).

How severe is CVE-2024-8061? +

CVE-2024-8061 has a CVSS v3.1 score of 7.5 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2024-8061? +

CVE-2024-8061 affects products from aimstack, specifically: aim. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-8061? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-8062 7.5

A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. The endpoint performs a …

CVE-2026-81520 7.5

A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by …

CVE-2026-89147 7.5

Net-SNMP through 5.9.5.2 contains a denial of service vulnerability in the SMUX module where smux_accept() performs an unauthenticated blocking read …

CVE-2024-12777 5.9

A vulnerability in aimhubio/aim version 3.25.0 allows for a denial of service through the misuse of the sshfs-client. The tracking …

CVE-2025-4656 3.1

Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled …

CVE-2024-2195 9.8

A critical Remote Code Execution (RCE) vulnerability was identified in the aimhubio/aim project, specifically within the `/api/runs/search/run/` endpoint, affecting versions …

CVE-2024-8061