CVE-2024-32874 json
In Frigate, Malicious Long Unicode filenames may cause a Multiple Application-level Denial of Service
published 2y ago modified 15d ago also EUVD-2024-1822 , GHSA-w4h6-9wrp-v5jq , PYSEC-2026-342
- cvss
- 6.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 56%
- public exploits
- 0
- none known
Summary
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Below 0.13.2 Release, when uploading a file or retrieving the filename, a user may intentionally use a large Unicode filename which would lead to a application-level denial of service. This is due to no limitation set on the length of the filename and the costy use of the Unicode normalization with the form NFKD under the hood of `secure_filename()`.
Patch / fix
Is CVE-2024-32874 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2y ago
Exploit prediction
0.77% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H |
| GitHub | 3.1 | 9.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H |
| OSV | 3.1 | 9.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | frigate | <0.13.2 |
0.13.2 |
Affected products
- blakeblackshear frigate
- frigate frigate
Classification
- Weakness
-
- CWE-770 Allocation of Resources Without Limits or Throttling
References
-
github.com
/blakeblackshear/frigate/commit/cc851555e4029647986dccc8b8ecf54afee31442
web
-
github.com
/blakeblackshear/frigate/security/advisories/GHSA-w4h6-9wrp-v5jq
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-32874
advisory
-
github.com
/blakeblackshear/frigate
package
-
github.com
/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L1346C46-L1346C55
web
-
github.com
/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L408C33-L408C78
web
-
github.com
/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L646C25-L646C47
web
-
github.com
/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L684C9-L684C59
web
-
github.com
/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L705C42-L705C88
web
-
github.com
/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L728C38-L728C80
web
-
github.com
/pypa/advisory-database/tree/main/vulns/frigate/PYSEC-2026-342.yaml
web
-
pypi.org
/project/frigate
web, package
-
github.com
/advisories/GHSA-w4h6-9wrp-v5jq
advisory
Sources
- CVE List CVE-2024-32874
- GitHub Advisory GHSA-w4h6-9wrp-v5jq
- NVD CVE-2024-32874
- OSV PYSEC-2026-342
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.