What’s Vulnerable › Vulnerabilities

CVE-2024-32874: In Frigate, Malicious Long Unicode filenames may cause a Multiple Application-level Denial of Service

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-14 · updated 2026-06-17
• Weakness: CWE-770

Description

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Below 0.13.2 Release, when uploading a file or retrieving the filename, a user may intentionally use a large Unicode filename which would lead to a application-level denial of service. This is due to no limitation set on the length of the filename and the costy use of the Unicode normalization with the form NFKD under the hood of `secure_filename()`.

Affected products

• blakeblackshear frigate: before 0.13.2 — fixed in 0.13.2

How to fix

Upgrade to a fixed version: blakeblackshear frigate 0.13.2. Check the vendor advisory for mitigations.

References

• https://github.com/blakeblackshear/frigate/commit/cc851555e4029647986dccc8b8ecf54afee31442
• https://github.com/blakeblackshear/frigate/security/advisories/GHSA-w4h6-9wrp-v5jq
• https://github.com/blakeblackshear/frigate/commit/cc851555e4029647986dccc8b8ecf54afee31442
• https://github.com/blakeblackshear/frigate/security/advisories/GHSA-w4h6-9wrp-v5jq

Get alerted when CVE-2024-32874 or the next vulnerability affects your stack