CVE-2026-53505

Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS

Published Jul 31, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion(<value>) filter does not enforce an upper bound on <value> and runs in the post-transform phase. An attacker can trigger extremely large resizes (CPU/memory exhaustion) and cause denial of service. This issue is fixed in 7.8.0.

Analysis

Technical impact

Thumbor's proportion filter accepts an arbitrary value, and the absence of an upper limit allows an attacker to request exceedingly large resize operations during the post‑transform phase. The resulting CPU and memory exhaustion can bring the service to a halt. This flaw is a classic example of a resource‑exhaustion weakness (CWE‑400).

Affected Systems

The vulnerability impacts the Thumbor open‑source photo thumbnail service supplied by globo.com. Any installation of Thumbor older than version 7.8.0 is affected. Corrections are included in release 7.8.0 and later.

Risk and Exploitability

The CVSS score of 7.5 reflects a significant likelihood of denial of service. The EPSS score of less than 1% indicates that exploitation is currently considered unlikely, and the vulnerability is not listed in CISA's KEV catalog. Based on the description, the attack vector is likely remote through a crafted HTTP request to the Thumbor service that invokes the unrestricted proportion filter. Once an attacker supplies a large proportion value, the service will consume excessive resources and become unavailable.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

thumbor

affected

Version	Status	Constraints
`< 7.8.0`	affected	—

No data.

Vendor Product Versions

Thumbor

Version	Status	Scheme	Platform
`[0,7.8.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Thumbor to version 7.8.0 or newer, which implements an upper bound on the proportion filter value.
If upgrading is not immediately possible, patch the local Thumbor repository with the commit that enforces the bound (see the GitHub commit referenced in the advisory).
Configure Thumbor to either disable the proportion filter or enforce a maximum proportion value via custom configuration or request validation to mitigate the resource‑exhaustion risk.

Generated by OpenCVE AI on August 2, 2026 at 03:58 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-phj3-59pf-cp83	Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.609% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/thumbor/thumbor/commit/2c716119de986cfc68c7071af52a98187e006023
https://github.com/thumbor/thumbor/releases/tag/7.8.0
https://github.com/thumbor/thumbor/security/advisories/GHSA-phj3-59pf-cp83

History

Aug 3, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 2, 2026 9:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Thumbor Thumbor thumbor
Vendors & Products		Thumbor Thumbor thumbor

Jul 31, 2026 7:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion(<value>) filter does not enforce an upper bound on <value> and runs in the post-transform phase. An attacker can trigger extremely large resizes (CPU/memory exhaustion) and cause denial of service. This issue is fixed in 7.8.0.
Title		Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS
Weaknesses		CWE-400
References		https://github.com/thumbor/thumbor/commit/2c716119de986cfc68c7071af52a98187e006023 https://github.com/thumbor/thumbor/releases/tag/7.8.0 https://github.com/thumbor/thumbor/security/advisories/GHSA-phj3-59pf-cp83
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`