CVE-2026-53503: Thumbor Denial of Service Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-cqjp-jf4r-h5q9",
  "modified" : "2026-07-31T18:54:55Z",
  "published" : "2026-07-31T18:54:55Z",
  "aliases" : [ "CVE-2026-53503" ],
  "summary" : "Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS",
  "details" : "### Summary\nThumbor's `filters:convolution(<matrix>, <columns>, <should_normalize>)` filter passes the user-controlled `<columns>` value to a C extension (`thumbor/ext/filters/_convolution.c`) where it is used as a divisor (for `%` and `/`) without validating `columns > 0`. When `columns=0`, the C code triggers undefined behavior; on x86_64 this reliably results in a fatal divide-by-zero trap (SIGFPE) and crashes the Thumbor process (confirmed on Linux x86_64 and macOS Intel x86_64), causing a remote denial of service.\n\n### Details\n#### Root cause\nThe Python filter accepts `columns=0`, and the native C extension uses `columns_count` as a divisor without validating it.\n\n1) Python filter entry point allows `columns=0` (`thumbor/filters/convolution.py`):\n```python\n@filter_method(\n    r\"(?:[-]?[\\d]+\\.?[\\d]*[;])*(?:[-]?[\\d]+\\.?[\\d]*)\",\n    BaseFilter.PositiveNumber,  # accepts 0\n    BaseFilter.Boolean,\n)\nasync def convolution(self, matrix, columns, should_normalize=True):\n    ...\n    imgdata = _convolution.apply(..., matrix, columns, should_normalize)\n```\n`BaseFilter.PositiveNumber` matches `\"0\"` (`thumbor/filters/__init__.py`):\n```python\nclass BaseFilter:\n    PositiveNumber = {\"regex\": r\"[\\d]+\", \"parse\": int}  # matches \"0\"\n    PositiveNonZeroNumber = {\"regex\": r\"[\\d]*[1-9][\\d]*\", \"parse\": int}\n```\n\n2) C extension divides/modulos by `columns_count` without a zero check (`thumbor/ext/filters/_convolution.c`):\n```c\nkernel_size = PyTuple_Size(kernel_tuple);\nif ((kernel_size % columns_count != 0) ||\n    (kernel_size % 2 == 0) ||\n    ((kernel_size / columns_count) % 2) == 0) {\n    // TODO: error, not a valid kernel\n    return NULL;\n}\n```\n\n\n### PoC\n#### Test environment\n- Linux x86_64\n\n#### Preconditions\n- The `convolution` filter is enabled (it is enabled by default via `BUILTIN_FILTERS`).\n- Either:\n  - `/unsafe/` URLs are allowed (`ALLOW_UNSAFE_URL=True`), OR\n  - `/unsafe/` is disabled, and the attacker has a valid signed URL (i.e., the attacker is an authorized user/partner, or can obtain signed URLs from a trusted signing service).\n\n#### Example request (signed URL)\n`http://<host>:<port>/<url-sign>/400x400/filters:convolution(1;2;1;2;4;2;1;2;1,0,true)/example.jpg`\n\n#### Example request (/unsafe/)\n`http://<host>:<port>/unsafe/400x400/filters:convolution(1;2;1;2;4;2;1;2;1,0,true)/example.jpg`\n\n\n### Impact\n- Remote Denial of Service via process crash (SIGFPE) on x86_64 (confirmed on Linux x86_64 and macOS Intel x86_64).\n- Exploitability depends on deployment:\n  - If `/unsafe/` is enabled: unauthenticated remote DoS.\n  - If `/unsafe/` is disabled: the attacker needs a valid signed URL.(i.e., the attacker is an authorized user/partner, or can obtain signed URLs from a trusted signing service)\n\n\n### Suggested remediation\n- In the C extension (`thumbor/ext/filters/_convolution.c`):\n  - Reject `columns_count <= 0` before any `%` or `/`.\n- In the Python filter (`thumbor/filters/convolution.py`):\n  - Require `columns` to be non-zero (e.g., use `BaseFilter.PositiveNonZeroNumber`).",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "thumbor"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "7.8.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 7.7.7"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/thumbor/thumbor/security/advisories/GHSA-cqjp-jf4r-h5q9"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/thumbor/thumbor/commit/447e192e3fb92e64c12e5354a56a4a7133f69d73"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/thumbor/thumbor"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/thumbor/thumbor/releases/tag/7.8.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-20", "CWE-369" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-31T18:54:55Z",
    "nvd_published_at" : null
  }
}