CVE-2026-53503
Received Received - Intake

Thumbor Process Crash via Convolution Filter Divide-by-Zero

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: GitHub, Inc.

Description
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution(<matrix>, <columns>, <should_normalize>) filter passes the user-controlled <columns> value to a C extension (thumbor/ext/filters/_convolution.c) where it is used as a divisor (for % and /) without validating columns > 0. When columns=0, the C code triggers undefined behavior; on x86_64 this reliably results in a fatal divide-by-zero trap (SIGFPE) and crashes the Thumbor process, causing a remote denial of service. This issue is fixed in 7.8.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-08-01
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-53503
EUVD
EUVD-2026-51609

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
globo.com thumbor to 7.8.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-369 The product divides a value by zero.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in Thumbor, an open-source photo thumbnail service. It involves the filters:convolution filter which passes a user-controlled 'columns' value to a C extension without validation. When 'columns' is set to 0, it causes a divide-by-zero error in the C code, leading to a crash of the Thumbor process. This results in a remote denial of service (DoS) attack.

Detection Guidance

The vulnerability can be detected by checking the Thumbor version in use. If it is below 7.8.0, the system is vulnerable. Commands like 'thumbor --version' or checking package managers (e.g., 'pip show thumbor') can help identify the version.

Impact Analysis

This vulnerability allows an attacker to remotely crash the Thumbor service by sending a specially crafted request with 'columns=0'. This causes the service to become unavailable, disrupting image processing and potentially affecting any applications or services relying on Thumbor for thumbnails.

Compliance Impact

This vulnerability causes a denial of service by crashing the Thumbor process, which could disrupt services handling sensitive data. For GDPR, this may impact availability of personal data processing. For HIPAA, service disruptions could affect access to protected health information. However, the CVE does not explicitly link this issue to compliance violations.

Mitigation Strategies

Immediately upgrade Thumbor to version 7.8.0 or later to patch the vulnerability. If upgrading is not possible, disable the convolution filter or restrict access to Thumbor endpoints until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53503. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart