Remote Denial of Service Vulnerability in Thumbor by Globo.com

CVE-2026-53503

What is CVE-2026-53503?

Thumbor, an open-source photo thumbnailing service developed by globo.com, contains a vulnerability where the filters:convolution(<matrix>, <columns>, <should_normalize>) function does not properly validate user inputs. Specifically, the user-controlled <columns> parameter is sent directly to a C extension without checks. If set to zero, this leads to undefined behavior in the code, especially causing a divide-by-zero error (SIGFPE) on x86_64 architectures. This flaw can result in a denial of service, crashing the Thumbor process. The issue was resolved in version 7.8.0.

References