CVE-2024-10110

HIGH

aimstack aim 3.23.0 - Denial of Service via ScheduledStatusReporter Main Thread Blocking

Title source: llm

Description

In version 3.23.0 of aimhubio/aim, the ScheduledStatusReporter object can be instantiated to run on the main thread of the tracking server, leading to the main thread being blocked indefinitely. This results in a denial of service as the tracking server becomes unable to respond to other requests.

References (1)

Core 1

Core References

Exploit, Third Party Advisory

https://huntr.com/bounties/5ea6cf56-7b4c-4dce-9b6c-3e910fbb1ae4

Scores

CVSS v3 7.5

EPSS 0.0034

EPSS Percentile 57.2%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-400

Status published

Products (2)

aimstack/aim 3.23.0

pypi/aim 3.15.0PyPI

Published Mar 20, 2025

Tracked Since Feb 18, 2026