CVE-2024-32874 json
In Frigate, Malicious Long Unicode filenames may cause a Multiple Application-level Denial of Service
published 2024-05-09 2 y ago modified 2026-10-27 12 d ago also EUVD-2024-1822 , GHSA-w4h6-9wrp-v5jq , PYSEC-2026-342
- cvss
- 6.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 55%
- public exploits
- 0
- none known
Summary
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Below 0.13.2 Release, when uploading a file or retrieving the filename, a user may intentionally use a large Unicode filename which would lead to a application-level denial of service. This is due to no limitation set on the length of the filename and the costy use of the Unicode normalization with the form NFKD under the hood of `secure_filename()`.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.77% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H |
| GitHub | 3.1 | 9.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H |
| OSV | 3.1 | 9.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | frigate | <0.13.2 |
0.13.2 |
Affected products
- blakeblackshear frigate
- frigate frigate
Classification
- Weakness
-
- CWE-770 Allocation of Resources Without Limits or Throttling
References
-
github.com
/blakeblackshear/frigate/commit/cc851555e4029647986dccc8b8ecf54afee31442
web
-
github.com
/blakeblackshear/frigate/security/advisories/GHSA-w4h6-9wrp-v5jq
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-32874
advisory
-
github.com
/blakeblackshear/frigate
package
-
github.com
/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L1346C46-L1346C55
web
-
github.com
/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L408C33-L408C78
web
-
github.com
/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L646C25-L646C47
web
-
github.com
/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L684C9-L684C59
web
-
github.com
/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L705C42-L705C88
web
-
github.com
/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L728C38-L728C80
web
-
github.com
/pypa/advisory-database/tree/main/vulns/frigate/PYSEC-2026-342.yaml
web
-
pypi.org
/project/frigate
web, package
-
github.com
/advisories/GHSA-w4h6-9wrp-v5jq
advisory
Sources
- CVE List CVE-2024-32874
- GitHub Advisory GHSA-w4h6-9wrp-v5jq
- NVD CVE-2024-32874
- OSV PYSEC-2026-342
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.