CVE-2024-32874 In Frigate, Malicious Long Unicode filenames may cause a Multiple Application-level Denial of Service
Attackers can cause application-level denial of service in Frigate by uploading files with excessively long Unicode filenames.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-32874?
CVE-2024-32874 is a medium-severity denial of service vulnerability in blakeblackshear frigate, published on 9 May 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Below 0.13.2 Release, when uploading a file or retrieving the filename, a user may intentionally use a large Unicode filename which would lead to a application-level denial of service. This is due to no limitation set on the length of the filename and the costy use of the Unicode normalization with the form NFKD under the hood of `secure_filename()`.
Weakness: CWE-770
Which versions are affected by CVE-2024-32874?
3 open source packages ship an affected version, including frigate.
| Package | Affected | Fixed in |
|---|---|---|
frigate PyPI | All versions | 0.13.2 |
frigate PyPI | All versions | 0.13.2 |
frigate PyPI | All versions | 0.13.2 |
How do I fix CVE-2024-32874?
Upgrade frigate to 0.13.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-32874 being exploited?
There is no known exploitation of CVE-2024-32874 in the wild and no public exploit code.
Sources
Also known as GHSA-w4h6-9wrp-v5jq, PYSEC-2026-342.