CVE-2026-53503: Thumbor Denial of Service Vulnerability

CVE-2026-53503 Overview

CVE-2026-53503 is a denial-of-service vulnerability in Thumbor, an open-source photo thumbnail service maintained by globo.com. The flaw exists in the filters:convolution(<matrix>, <columns>, <should_normalize>) filter, which forwards a user-controlled columns value to a C extension at thumbor/ext/filters/_convolution.c. The value is used as a divisor for modulo and division operations without validation that it is greater than zero. When an attacker submits columns=0, the C code triggers undefined behavior. On x86_64 systems this reliably produces a SIGFPE divide-by-zero trap and crashes the Thumbor process. The issue is fixed in version 7.8.0.

Critical Impact

An unauthenticated remote attacker can crash the Thumbor process by sending a single crafted image transformation request, resulting in denial of service.

Affected Products

• Thumbor versions prior to 7.8.0
• Deployments exposing the filters:convolution filter over HTTP
• The native C extension thumbor/ext/filters/_convolution.c

Discovery Timeline

• 2026-07-31 - CVE-2026-53503 published to the National Vulnerability Database
• 2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-53503

Vulnerability Analysis

Thumbor exposes a URL-based image processing API, and the convolution filter accepts three parameters: a matrix of kernel values, a columns count, and a should_normalize boolean. The Python wrapper in thumbor/filters/convolution.py validated columns only as a PositiveNumber, which permits zero. The value flows into the native extension where the kernel size validation uses kernel_size % columns_count and kernel_size / columns_count. Dividing by zero on x86_64 raises a hardware SIGFPE exception that terminates the worker process. Because the filter is reachable through crafted image URLs without authentication, any exposed Thumbor instance can be crashed remotely. The classification is [CWE-20] Improper Input Validation.

Root Cause

The root cause is missing bounds validation on an integer parameter that is used as a divisor. The Python filter decorator allowed zero to pass through to native code, and the C extension performed arithmetic without a guard clause. Undefined behavior in C division by zero produces a trap on most CPU architectures.

Attack Vector

An attacker sends an HTTP request to a Thumbor endpoint that includes the convolution filter with columns set to 0. No authentication or user interaction is required. Confidentiality and integrity are not impacted, but availability is fully lost until the process is restarted.

// Patch in thumbor/ext/filters/_convolution.c
    }

    kernel_size = PyTuple_Size(kernel_tuple);
+    if (columns_count <= 0) {
+        PyErr_SetString(PyExc_ValueError, "columns must be greater than 0");
+        return NULL;
+    }
    if ((kernel_size % columns_count != 0) || (kernel_size % 2 == 0) || ((kernel_size / columns_count) % 2) == 0) {
        // TODO: error, not a valid kernel
        return NULL;

Source: GitHub Commit 447e192

Detection Methods for CVE-2026-53503

Indicators of Compromise

• HTTP request logs containing filters:convolution( with a columns parameter equal to 0, for example filters:convolution(1;2;3;4,0,true).
• Thumbor worker processes terminating with signal SIGFPE or exit code 136 in supervisor and container logs.
• Repeated 502 or 504 responses from a reverse proxy fronting Thumbor after malformed convolution filter requests.

Detection Strategies

• Parse Thumbor access logs for the convolution filter and alert when the second argument is 0 or non-positive.
• Instrument process supervisors such as systemd, supervisord, or Kubernetes to alert on abnormal restart rates of Thumbor workers.
• Deploy a Web Application Firewall rule that inspects URL path segments for the pattern convolution\([^,]*,\s*0\s*,.

Monitoring Recommendations

• Track Thumbor worker restart counts and correlate with inbound request bursts.
• Forward Thumbor and reverse-proxy logs to a central SIEM for query and alerting on filter parameter patterns.
• Monitor availability metrics for image endpoints and set thresholds that fire on sustained 5xx spikes.

How to Mitigate CVE-2026-53503

Immediate Actions Required

• Upgrade Thumbor to version 7.8.0 or later, which enforces columns > 0 in both the Python filter decorator and the C extension.
• If upgrade is not immediately possible, block the convolution filter at the reverse proxy or WAF layer until patching completes.
• Restart Thumbor workers automatically on crash and rate-limit anonymous requests to reduce impact during exploitation attempts.

Patch Information

The fix is available in Thumbor Release 7.8.0 and applied in commit 447e192. The Python filter now uses BaseFilter.PositiveNonZeroNumber for the columns argument, and the C extension raises a ValueError when columns_count <= 0. Full advisory details are published in GHSA-cqjp-jf4r-h5q9.

# Patch in thumbor/filters/convolution.py
    @filter_method(
        r"(?:[-]?[\d]+\.?[\d]*[;])*(?:[-]?[\d]+\.?[\d]*)",
-       BaseFilter.PositiveNumber,
+       BaseFilter.PositiveNonZeroNumber,
        BaseFilter.Boolean,
    )
    async def convolution(self, matrix, columns, should_normalize=True):

Source: GitHub Commit 447e192

Workarounds

• Disable the convolution filter by removing it from the FILTERS list in thumbor.conf until the service is upgraded.
• Add a reverse-proxy rule that rejects requests whose URL contains convolution( followed by a zero second argument.
• Run Thumbor behind a process supervisor with automatic restart and per-client rate limiting to reduce the availability impact of crash attempts.

# Example nginx rule to block malicious convolution filter requests
location / {
    if ($request_uri ~* "convolution\([^,]*,\s*0\s*,") {
        return 400;
    }
    proxy_pass http://thumbor_backend;
}