Cyber Resilience

CVE-2025-0190

Aimstack Aim 3.25.0

Public PoC
Published
20 March 2025
Modified
28 March 2025
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0059 45th percentile
Risk Priority 58 floored blend · peak EPSS

Summary

CVE-2025-0190 is a high-severity Excessive Data Query Operations in a Large Data Table (CWE-1049) vulnerability in Aimstack Aim. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 45th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SC-6 (Resource Availability) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2025-0190 is a denial of service vulnerability affecting version 3.25.0 of aimhubio/aim. The flaw occurs when a large number of Text objects are tracked and then queried simultaneously through the web API, causing the Aim web server to become unresponsive to other requests for an extended period while processing and returning these objects. It is rated with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-1049 and NVD-CWE-Other.

The vulnerability can be exploited by any unauthenticated attacker with network access to the Aim web server, requiring low complexity and no user interaction. By repeatedly tracking large volumes of Text objects and issuing simultaneous queries via the web API, an attacker can render the server unresponsive, leading to a complete denial of service.

Mitigation details and additional information are available in the advisory published on Huntr at https://huntr.com/bounties/38d151f1-abb4-443a-86b0-6c26f0c6cb70.

EU & UK References

Vulnerability Data

In version 3.25.0 of aimhubio/aim, a denial of service vulnerability exists. By tracking a large number of `Text` objects and then querying them simultaneously through the web API, the Aim web server becomes unresponsive to other requests for an extended…

more

period while processing and returning these objects. This vulnerability can be exploited repeatedly, leading to a complete denial of service.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1499 Endpoint Denial of Service Impact
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.
T1499.003 Application Exhaustion Flood Impact
Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-6227Same product: Aimstack Aim
CVE-2024-12777Same product: Aimstack Aim
CVE-2024-8061Same product: Aimstack Aim
CVE-2024-10110Same product: Aimstack Aim
CVE-2025-0189Same product: Aimstack Aim
CVE-2024-12778Same product: Aimstack Aim
CVE-2024-6483Same product: Aimstack Aim
CVE-2024-8238Same product: Aimstack Aim
CVE-2024-7760Same product: Aimstack Aim
CVE-2024-8769Same product: Aimstack Aim

Affected Assets

aimstack
aim
3.25.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V4.3.1

Mitigating Controls (NIST 800-53 r5) AI

Developer testing and evaluation can discover inefficient large-table queries during development or updates.

Resource allocation limits the availability impact of expensive joins/sub-queries without stopping the inefficient code.

System monitoring can observe and flag excessive query volume or duration after the weakness is exercised.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prevent inefficient query patterns through reviews and testing.

DE.CM-09 partial match
prevents

Runtime monitoring of data and software can detect excessive query operations as adverse events.

ID.RA-01 partial match
prevents

Vulnerability identification processes can surface this weakness during assessments.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing in development can detect performance issues caused by excessive query operations.

prevents

Secure development lifecycle requires design and code reviews that can catch excessive joins before deployment.

prevents

Application security requirements can mandate query-performance and data-volume constraints.

prevents

Secure architecture principles include database design and indexing standards that mitigate large-table query risks.

prevents

Secure coding rules directly prohibit or limit complex joins and sub-queries on large tables.

finds

Capacity management identifies and mitigates resource exhaustion from inefficient large-table queries.

References