CVE-2024-32874

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Below 0.13.2 Release, when uploading a file or retrieving the filename, a user may intentionally use a large Unicode filename which would lead to a application-level denial of service. This is due to no limitation set on the length of the filename and the costy use of the Unicode normalization with the form NFKD under the hood of `secure_filename()`.

• CWE-770

• https://github.com/blakeblackshear/frigate/commit/cc851555e4029647986dccc8b8ecf54afee31442
• https://github.com/blakeblackshear/frigate/security/advisories/GHSA-w4h6-9wrp-v5jq
• https://github.com/blakeblackshear/frigate/commit/cc851555e4029647986dccc8b8ecf54afee31442
• https://github.com/blakeblackshear/frigate/security/advisories/GHSA-w4h6-9wrp-v5jq

Published

May 14, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-32869Hono is a Web application framework that provides support fo…5.3
• CVE-2024-3287The SmartCrawl WordPress SEO checker, SEO analyzer, SEO opti…5.3
• CVE-2024-32870Combodo iTop is a simple, web based IT Service Management to…5.8
• CVE-2024-32871Pimcore is an Open Source Data & Experience Management Platf…7.5
• CVE-2024-32872Umbraco workflow provides workflows for the Umbraco content …5.5
• CVE-2024-32873Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmo…4.3
• CVE-2024-32875Hugo is a static site generator. Starting in version 0.123.0…6.1
• CVE-2024-32876NewPipe is an Android app for video streaming written in Jav…8.5
• CVE-2024-32877Yii 2 is a PHP application framework. During internal penetr…4.7
• CVE-2024-32878Llama.cpp is LLM inference in C/C++. There is a use of unini…8.8
• CVE-2024-32879Python Social Auth is a social authentication/registration m…4.9
• CVE-2024-3288The Logo Slider WordPress plugin before 4.0.0 does not vali…5.4