high · 7.5CVE-2026-53503Jul 31, 2026

CVE-2026-53503: thumbor convolution filter remote divide-by-zero DoS

Shubham Kandhare
Security Engagement Manager, SecureLayer7

Passing columns=0 to thumbor's convolution filter triggers a fatal divide-by-zero crash in native C code, letting any attacker with URL access take down the image-processing server.

Packagethumbor
Ecosystempip
Affected<= 7.7.7
Fixed in7.8.0
CVE-2026-53503: thumbor convolution filter remote divide-by-zero DoS

The problem

Thumbor's built-in filters:convolution(<matrix>, <columns>, <should_normalize>) accepts columns=0 because the Python-layer type BaseFilter.PositiveNumber matches the regex [\d]+, which includes zero.

That zero is forwarded directly into a C extension (thumbor/ext/filters/_convolution.c) where it is used as a divisor in both % and / operations with no prior bounds check. On x86_64 Linux and macOS Intel, this produces a SIGFPE that kills the Thumbor worker process, causing a remote denial of service.

If /unsafe/ URLs are enabled (the default in many dev deployments), the attack is fully unauthenticated. With unsafe URLs disabled, a valid signed URL is sufficient.

Proof of concept

A working proof-of-concept for CVE-2026-53503 in thumbor, with the exact payload below.

http
GET /unsafe/400x400/filters:convolution(1;2;1;2;4;2;1;2;1,0,true)/example.jpg HTTP/1.1
Host: <thumbor-host>:<port>

The Python entry point uses BaseFilter.PositiveNumber = {"regex": r"[\d]+", "parse": int}, which happily parses "0". The value is then passed as columns_count to the C extension, which immediately performs kernel_size % columns_count and kernel_size / columns_count with no guard.

The fix in 7.8.0 (commit 447e192) replaces PositiveNumber with PositiveNonZeroNumber (regex [\d]*[1-9][\d]*) at the Python layer, and adds an explicit columns_count <= 0 rejection at the top of the C function before any arithmetic. Both layers are patched so that neither alone is a single point of failure.

Root cause CWE: CWE-369 (Divide By Zero) enabled by CWE-20 (Improper Input Validation).

The fix

Upgrade to thumbor 7.8.0 (pip install --upgrade thumbor). The release changes the filter argument type from PositiveNumber to PositiveNonZeroNumber in convolution.py and adds a columns_count <= 0 early-return guard in _convolution.c. No configuration change is needed after upgrading.

Reporter not attributed.

References: [1][2][3][4]

Related research