high · 7.5CVE-2026-53505Jul 31, 2026

CVE-2026-53505: thumbor proportion filter Remote Denial of Service

Shubham Kandhare
Security Engagement Manager, SecureLayer7

Thumbor's proportion filter accepts arbitrarily large multiplier values, letting any attacker trigger a massive image resize that exhausts CPU and memory and crashes the server.

Packagethumbor
Ecosystempip
Affected<= 7.7.7
Fixed in7.8.0
CVE-2026-53505: thumbor proportion filter Remote Denial of Service

The problem

The filters:proportion(<value>) filter in thumbor multiplies the requested image dimensions by value and calls engine.resize() with the result. The parameter is parsed as an unbounded float with no maximum enforced.

Because the filter runs in the POST_TRANSFORM phase, it executes after the main pipeline's MAX_WIDTH/MAX_HEIGHT guards have already been applied to req.width/req.height. A value like 10000 turns a modest 100x100 request into a 1,000,000x1,000,000 resize, causing CPU and memory exhaustion and likely an OOM kill.

Proof of concept

A working proof-of-concept for CVE-2026-53505 in thumbor, with the exact payload below.

http
# /unsafe/ enabled (unauthenticated)
GET http://<host>:<port>/unsafe/100x100/filters:proportion(10000)/example.jpg

# signed URL (authorized user or partner)
GET http://<host>:<port>/<url-sign>/100x100/filters:proportion(10000)/example.jpg

The root cause is missing input validation: proportion.py accepted any DecimalNumber and passed source_width * value / source_height * value straight to engine.resize(). No upper bound was ever asserted, contradicting the documented range of 0.0 to 1.0.

The patch at commit 2c716119 adds an explicit check that rejects or clamps any value greater than 1.0, aligning the implementation with its own documentation. CWE-400 (Uncontrolled Resource Consumption) applies directly: one HTTP request, no authentication required if /unsafe/ is on.

The fix

Upgrade to thumbor 7.8.0 (pip install --upgrade thumbor). If an immediate upgrade is not possible, disable the proportion filter by removing it from BUILTIN_FILTERS in your thumbor config. Also disable ALLOW_UNSAFE_URL to require signed URLs, which at minimum limits exposure to authenticated parties.

Reporter not attributed.

References: [1][2][3][4]

Related research