Medium severity · published May 9, 2024
CVE-2024-32874
In Frigate, Malicious Long Unicode filenames may cause a Multiple Application-level Denial of Service
6.8
CVSS
0.8%
EPSS
No
On KEV
Description
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Below 0.13.2 Release, when uploading a file or retrieving the filename, a user may intentionally use a large Unicode filename which would lead to a application-level denial of service. This is due to no limitation set on the length of the filename and the costy use of the Unicode normalization with the form NFKD under the hood of `secure_filename()`.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
frigate · blakeblackshear
<= 0.13.2 · source: vendor, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-32874
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-32874
github.com
https://github.com/blakeblackshear/frigate/commit/cc851555e4029647986dccc8b8ecf54afee31442
github.com
https://github.com/blakeblackshear/frigate/security/advisories/GHSA-w4h6-9wrp-v5jq
More from frigate
9.1
CVE-2026-25643
Frigate Affected by Authenticated Remote Command Execution (RCE) and Container Escape
8.8
CVE-2026-33124
Frigate has insecure password change functionality
8.1
CVE-2026-75607
Frigate: WebSocket Missing Authorization — Viewer Can Execute Admin-Only Operations
8.1
CVE-2026-54652
Frigate viewer can read logs exposing admin and camera credentials
8.1
CVE-2026-33125
Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts