CVE-2024-8061

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In version 3.23.0 of aimhubio/aim, certain methods that request data from external servers do not have set timeouts, causing the server to wait indefinitely for a response. This can lead to a denial of service, as the tracking server does not respond to other requests while waiting. The issue arises in the client used by the `aim` tracking server to communicate with external resources, specifically in the `_run_read_instructions` method and similar calls without timeouts.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1088

Affected software

Vendor	Product	Versions
aimhubio	aimhubio/aim	>= unspecified, <= latest

References

https://huntr.com/bounties/c85d005c-b354-4c51-a88f-adda2f09622bExploit, Third Party Advisory

Timeline

Published: Mar 20, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-80627.5A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. The endpoint performs a `HEAD` reque CVE-2024-80637.5A divide by zero vulnerability exists in ollama/ollama version v0.3.3. The vulnerability occurs when importing GGUF models with a crafted ty CVE-2024-80658.1A Cross-Site Request Forgery (CSRF) vulnerability in version v1.4.1 of danswer-ai/danswer allows attackers to perform unauthorized actions i CVE-2024-80668.8The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing validation in the 'fsConnector' CVE-2024-80675.8In versions of Helix Core prior to 2024.1 Patch 2 (2024.1/2655224) a Windows ANSI API Unicode "best fit" argument injection was identified.CVE-2024-80688.0Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Wind CVE-2024-80698.0Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authentica CVE-2024-80708.5CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that exposes test credentials in the firmware binary CVE-2024-80717.2Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to restrict which roles can promote a user as s CVE-2024-80725.3Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users CVE-2024-80739.8Improper Input Validation vulnerability in Hillstone Networks Hillstone Networks Web Application Firewall on 5.5R6 allows Command Injection.CVE-2024-80749.3Missing Authentication for Critical Function, Missing Authorization vulnerability in Nomysoft Informatics Nomysem allows Collect Data as Pro