CVE-2026-53505
Received Received - Intake

Proportion Filter DoS in Thumbor Prior to 7.8.0

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: GitHub, Inc.

Description
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion(<value>) filter does not enforce an upper bound on <value> and runs in the post-transform phase. An attacker can trigger extremely large resizes (CPU/memory exhaustion) and cause denial of service. This issue is fixed in 7.8.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-08-01
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-53505
EUVD
EUVD-2026-51611

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
globo.com thumbor to 7.8.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Thumbor is an open-source photo thumbnail service. A vulnerability exists in versions prior to 7.8.0 where the filters:proportion filter does not limit the resize value. This allows attackers to request extremely large image resizes, causing excessive CPU and memory usage leading to denial of service.

Detection Guidance

Monitor for unusually high CPU or memory usage from Thumbor processes. Check for excessive resize operations in logs. No specific commands are provided in the context.

Impact Analysis

This vulnerability can cause system slowdowns or crashes due to high resource consumption. If exploited, it may disrupt services relying on Thumbor for image processing, leading to downtime or degraded performance.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt services handling personal or health data. GDPR requires data protection and availability, while HIPAA mandates safeguards for protected health information. Resource exhaustion from this flaw may violate these requirements.

Mitigation Strategies

Upgrade Thumbor to version 7.8.0 or later to fix the issue. If immediate upgrade is not possible, restrict access to Thumbor or disable the proportion filter.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53505. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart