CVE-2026-53505: Thumbor DOS Vulnerability

CVE-2026-53505 Overview

CVE-2026-53505 is a denial-of-service vulnerability in Thumbor, an open-source photo thumbnail service maintained by globo.com. Versions prior to 7.8.0 fail to enforce an upper bound on the value passed to the filters:proportion(<value>) filter. The filter executes in the post-transform phase, which means an unauthenticated remote attacker can request extremely large resize operations. These operations exhaust CPU and memory, causing service unavailability. The issue is classified under [CWE-400] (Uncontrolled Resource Consumption) and is fixed in release 7.8.0.

Critical Impact
An unauthenticated attacker can trigger unbounded image resize operations that exhaust CPU and memory, taking Thumbor services offline.

Affected Products

Thumbor image processing service, versions prior to 7.8.0
Deployments exposing the filters:proportion filter to untrusted input
Container and cloud workloads embedding vulnerable Thumbor builds

Discovery Timeline

2026-07-31 - CVE-2026-53505 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-53505

Vulnerability Analysis

Thumbor exposes an HTTP interface that applies chained image transformations defined in the request URL. The filters:proportion(<value>) filter multiplies the source image dimensions by the user-supplied value to compute new width and height. Prior to 7.8.0, the filter accepted any decimal number without bounds checking.

Because the filter runs in the post-transform phase, it operates on the already-decoded image buffer. Supplying a large value forces the engine to allocate a resize target proportional to the square of that value. A single crafted request can therefore consume gigabytes of memory and pin CPU cores until the process is killed or the host swaps to death.

Root Cause

The root cause is missing input validation in thumbor/filters/proportion.py. The proportion filter method received a DecimalNumber argument and used it directly to scale source_width and source_height. No sanity range check rejected negative, zero, or greater-than-one values before the multiplication and subsequent resize call.

Attack Vector

Exploitation requires only network access to a Thumbor endpoint that permits the proportion filter in image URLs. The attacker crafts a URL of the form /filters:proportion(<large_value>)/<image> referencing any processable image. No authentication, privileges, or user interaction are required. Repeated requests amplify the impact and can take down clustered deployments.

python

# Security patch in thumbor/filters/proportion.py
# fix(filters): cap proportion value to prevent DoS
 class Filter(BaseFilter):
     @filter_method(BaseFilter.DecimalNumber)
     async def proportion(self, value):
+        if value <= 0 or value > 1.0:
+            return
+
         source_width, source_height = self.context.request.engine.size
 
         new_width = source_width * value
# Source: https://github.com/thumbor/thumbor/commit/2c716119de986cfc68c7071af52a98187e006023

The patch rejects any value less than or equal to zero or greater than 1.0, returning early without performing the resize. This bounds the target dimensions to the source dimensions.

Detection Methods for CVE-2026-53505

Indicators of Compromise

HTTP requests to Thumbor endpoints containing filters:proportion( with numeric arguments greater than 1.0 or with unusually long decimal literals.
Thumbor worker processes exhibiting sustained high memory (multi-GB) or CPU usage tied to a single request identifier.
Repeated OOMKilled events or worker restarts in container orchestrators hosting Thumbor.
Reverse-proxy logs showing bursts of image requests from a single source producing 5xx or timeout responses.

Detection Strategies

Parse Thumbor access logs and alert when the proportion filter argument exceeds 1.0.
Instrument the Thumbor engine to record post-transform output dimensions and flag targets that exceed source dimensions.
Correlate application-tier memory spikes with concurrent inbound image requests to identify resource-exhaustion patterns.

Monitoring Recommendations

Track resident set size and CPU per Thumbor worker and alert on sustained saturation.
Monitor 5xx rates, request duration percentiles, and container restart counts for Thumbor services.
Enable structured logging of filter chains and forward events to a centralized analytics platform for baseline analysis.

How to Mitigate CVE-2026-53505

Immediate Actions Required

Upgrade all Thumbor deployments to version 7.8.0 or later, which enforces the 0 < value <= 1.0 bound in the proportion filter.
Inventory container images, Helm charts, and derived services that embed Thumbor and rebuild them against the patched release.
Restrict inbound access to Thumbor to trusted upstream callers where feasible until patching completes.

Patch Information

The fix is included in the Thumbor 7.8.0 release. The relevant code change is documented in the upstream commit and the GHSA-phj3-59pf-cp83 advisory.

Workarounds

Deploy a reverse-proxy or WAF rule that rejects Thumbor URLs whose filters:proportion(...) argument is not a decimal between 0 and 1.
Enforce per-worker memory limits with cgroups or Kubernetes resources.limits so a single request cannot exhaust the host.
Apply rate limiting on the Thumbor endpoint to reduce amplification from repeated malicious requests.
Disable the proportion filter in the Thumbor configuration if it is not required by the application.

bash

# Example reverse-proxy filter rejecting out-of-range proportion values (nginx)
location / {
    if ($request_uri ~* "filters:proportion\((-|[2-9]|[0-9]{2,})") {
        return 400;
    }
    proxy_pass http://thumbor_upstream;
}