Threats tagged 'ghsa-w4h6-9wrp-v5jq'

CVE-2024-32874 is a critical application-level denial of service vulnerability in Frigate versions prior to 0.13.2. It arises when an attacker with access to the Frigate instance uploads or uses extremely long Unicode filenames, which trigger costly Unicode normalization operations in the secure_filename() function. This can exhaust CPU resources and cause the application to become unresponsive. Exploitation requires attacker access to the Frigate instance, and proper authentication can prevent exploitation. A fix is available in version 0.13.2.