In Frigate, Malicious Long Unicode filenames may cause a Multiple Application-level Denial of Service
Priority LOW 31CWE-770Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.
Summary
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Below 0.13.2 Release, when uploading a file or retrieving the filename, a user may intentionally use a large Unicode filename which would lead to a application-level denial of service. This is due to no limitation set on the length of the filename and the costy use of the Unicode normalization with the form NFKD under the hood of `secure_filename()`.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00774 55th percentileScored 2026-11-07
Fix Fixed frigate (PyPI): 0.13.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| blakeblackshear | frigate | up to 0.13.2 | — | No fix listed | CNA |
| — | frigate (PyPI) | before 0.13.2 | 0.13.2 | Patch available | GHSA-w4h6-9wrp-v5jq |
- frigate Vendorblakeblackshear Affected up to 0.13.2 Fixed in — No fix listed CNA
- frigate (PyPI) Vendor— Affected before 0.13.2 Fixed in 0.13.2 Patch available GHSA-w4h6-9wrp-v5jq
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:frigate:frigate:*:*:*:*:*:*:*:* | — | — | blakeblackshear |
- cpe:2.3:a:frigate:frigate:*:*:*:*:*:*:*:* Versions — — ·blakeblackshear
Remediation
- Fix · GHSA-w4h6-9wrp-v5jq frigate (PyPI) Fixed in 0.13.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-32874
- 2026-10-03 Alias added: GHSA-w4h6-9wrp-v5jq
References
Other 11
- https://github.com/blakeblackshear/frigate/security/advisories/GHSA-w4h6-9wrp-v5jq
- https://github.com/blakeblackshear/frigate/commit/cc851555e4029647986dccc8b8ecf54afee31442
- https://github.com/blakeblackshear/frigate
- https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L1346C46-L1346C55
- https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L408C33-L408C78
- https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L646C25-L646C47
- https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L684C9-L684C59
- https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L705C42-L705C88
- https://github.com/blakeblackshear/frigate/blob/d7ae0eedf89e14f297093ac5c8042862034cbaeb/frigate/api/media.py#L728C38-L728C80
- https://github.com/pypa/advisory-database/tree/main/vulns/frigate/PYSEC-2026-342.yaml
- https://pypi.org/project/frigate
More blakeblackshear vulnerabilities
- TI-2026-20743 Frigate Affected by Authenticated Remote Command Execution (RCE) and Container Escape CVSS 3.1CRITICAL 9.1
- TI-2026-39479 Frigate viewer can read logs exposing admin and camera credentials CVSS 3.1HIGH 8.1
- TI-2026-52911 Frigate: WebSocket Missing Authorization — Viewer Can Execute Admin-Only Operations CVSS 3.1HIGH 8.1
- TI-2026-25557 Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts CVSS 3.1HIGH 8.1
- TI-2026-52912 Frigate: Viewer-Role User Can Access go2rtc Internal API to obtain sensitive information CVSS 3.1HIGH 7.7
- TI-2025-38649 Frigate Vulnerable to Arbitrary File Read via Export Thumbnail "image_path" parameter CVSS 3.1HIGH 7.7
Sources
- CVE-2024-32874 · CVE Program
- CVE-2024-32874 · NVD
- FIRST EPSS
- GHSA-w4h6-9wrp-v5jq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences