What is CVE-2025-0189?

CVE-2025-0189 is a high-severity vulnerability in Aimhubio Aimhubio/aim, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 7.5/10. Published 2025-03-20.

How severe is CVE-2025-0189?

High severity. CVSS v3 base score is 7.5 out of 10.

Resource exhaustion in Aimhubio Aimhubio/aim

CVE-2025-0189

In version 3.25.0 of aimhubio/aim, the tracking server is vulnerable to a denial of service attack. The server overrides the maximum size for websocket messages, allowing very large images to be tracked. This causes the server to become unresponsive to other requests while processing the large image, leading to a denial of service condition.

EPSS: 0.006 (44.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Aimhubio Aimhubio/aim — versions unspecified
Aimstack Aim — versions 3.25.0

Weakness classification (CWE)

CWE-770 — Allocation of Resources Without Limits or Throttling

References

security@huntr.dev (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2025-0189?: CVE-2025-0189 is a high-severity vulnerability in Aimhubio Aimhubio/aim, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 7.5/10. Published 2025-03-20.
How severe is CVE-2025-0189?: High severity. CVSS v3 base score is 7.5 out of 10.