Thumbor's proportion filter accepts an arbitrary value, and the absence of an upper limit allows an attacker to request exceedingly large resize operations during the post‑transform phase. The resulting CPU and memory exhaustion can bring the service to a halt. This flaw is a classic example of a resource‑exhaustion weakness (CWE‑400).

The vulnerability impacts the Thumbor open‑source photo thumbnail service supplied by globo.com. Any installation of Thumbor older than version 7.8.0 is affected. Corrections are included in release 7.8.0 and later.

The CVSS score of 7.5 reflects a significant likelihood of denial of service. The EPSS score of less than 1% indicates that exploitation is currently considered unlikely, and the vulnerability is not listed in CISA's KEV catalog. Based on the description, the attack vector is likely remote through a crafted HTTP request to the Thumbor service that invokes the unrestricted proportion filter. Once an attacker supplies a large proportion value, the service will consume excessive resources and become unavailable.