Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-e4mr-cym9-qqak
Vulnerability ID VCID-e4mr-cym9-qqak
Aliases CVE-2025-0189
GHSA-j5qj-rg5j-j7c2
Summary In version 3.25.0 of aimhubio/aim, the tracking server is vulnerable to a denial of service attack. The server overrides the maximum size for websocket messages, allowing very large images to be tracked. This causes the server to become unresponsive to other requests while processing the large image, leading to a denial of service condition.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-400 Uncontrolled Resource Consumption
CWE-770 Allocation of Resources Without Limits or Throttling
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00578 https://api.first.org/data/v1/epss?cve=CVE-2025-0189
epss 0.00578 https://api.first.org/data/v1/epss?cve=CVE-2025-0189
epss 0.00578 https://api.first.org/data/v1/epss?cve=CVE-2025-0189
cvssv3.1 7.5 https://github.com/aimhubio/aim
generic_textual HIGH https://github.com/aimhubio/aim
cvssv3 7.5 https://huntr.com/bounties/e4c9bf41-72cf-4d04-baaf-8f12b5b7926e
cvssv3.1 7.5 https://huntr.com/bounties/e4c9bf41-72cf-4d04-baaf-8f12b5b7926e
generic_textual HIGH https://huntr.com/bounties/e4c9bf41-72cf-4d04-baaf-8f12b5b7926e
ssvc Track https://huntr.com/bounties/e4c9bf41-72cf-4d04-baaf-8f12b5b7926e
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2025-0189
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2025-0189
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-0189
https://nvd.nist.gov/vuln/detail/CVE-2025-0189
e4c9bf41-72cf-4d04-baaf-8f12b5b7926e https://huntr.com/bounties/e4c9bf41-72cf-4d04-baaf-8f12b5b7926e
GHSA-j5qj-rg5j-j7c2 https://github.com/advisories/GHSA-j5qj-rg5j-j7c2
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/aimhubio/aim
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://huntr.com/bounties/e4c9bf41-72cf-4d04-baaf-8f12b5b7926e
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://huntr.com/bounties/e4c9bf41-72cf-4d04-baaf-8f12b5b7926e
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-03-20T17:50:24Z/ Found at https://huntr.com/bounties/e4c9bf41-72cf-4d04-baaf-8f12b5b7926e
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2025-0189
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.69319
EPSS Score 0.00578
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:14:04.573366+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2025/0xxx/CVE-2025-0189.json 38.6.0