---
id: CVE-2024-8061
aliases:
  - GHSA-6w7p-xrvp-p7xv
  - PYSEC-2026-1083
title: >-
  Aim allows denial of service due to no timeouts for some tracking server
  endpoints
summary: >-
  Aim allows denial of service due to no timeouts for some tracking server
  endpoints
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: aim
product: aim
ecosystem: pip
affected:
  - aim <= 3.23.0
published: '2025-03-20'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-6w7p-xrvp-p7xv'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-8061'
  - url: 'https://github.com/aimhubio/aim'
  - url: >-
      https://github.com/aimhubio/aim/blob/a6c6f2fee0f1abe37c1d66701b0329fb6af31a3d/aim/ext/transport/client.py#L258
  - url: 'https://huntr.com/bounties/c85d005c-b354-4c51-a88f-adda2f09622b'
tags:
  - osv
  - pip
epss: 0.00473
epssPercentile: 0.40091
ingestedAt: '2026-07-08T18:25:46.549Z'
---

## Overview

In version 3.23.0 of aimhubio/aim, certain methods that request data from external servers do not have set timeouts, causing the server to wait indefinitely for a response. This can lead to a denial of service, as the tracking server does not respond to other requests while waiting. The issue arises in the client used by the `aim` tracking server to communicate with external resources, specifically in the `_run_read_instructions` method and similar calls without timeouts.

## Affected packages

- `aim <= 3.23.0`

## Remediation

Refer to the advisory for the patched release.