CVE-2026-53503

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-53503
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53503.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-53503
Aliases
Downstream
Published
2026-07-31T18:54:20.747Z
Modified
2026-08-02T09:08:28.610622Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS
Details

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution(<matrix>, <columns>, <should_normalize>) filter passes the user-controlled <columns> value to a C extension (thumbor/ext/filters/convolution.c) where it is used as a divisor (for % and /) without validating columns > 0. When columns=0, the C code triggers undefined behavior; on x8664 this reliably results in a fatal divide-by-zero trap (SIGFPE) and crashes the Thumbor process, causing a remote denial of service. This issue is fixed in 7.8.0.

Database specific 
{
    "cwe_ids": [
        "CWE-20",
        "CWE-369"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53503.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/thumbor/thumbor

Affected ranges

Type
GIT
Repo
https://github.com/thumbor/thumbor
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
447e192e3fb92e64c12e5354a56a4a7133f69d73
Fixed
a366291cfcd29ec140911c97ee8e0e794f2a40f9
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "7.8.0"
        }
    ]
}

Affected versions

0.*
0.1.0
0.1.1
0.2.0
0.2.1
0.3.0
0.3.1
0.4.0
0.4.1
0.5.0
0.5.1
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.7.0
0.7.10
0.7.11
0.7.12
0.7.13
0.7.14
0.7.9
0.8.0
0.8.2
0.8.3
0.8.4
0.9.0
0.9.1
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
2.*
2.0.2
2.0.4
2.0.5
2.3.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.4.9
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.8
2.8.0
2.8.1
3.*
3.0.0
3.0.1
3.0.2
3.1.0
3.1.1
3.10.0
3.10.1
3.10.2
3.11.0
3.11.1
3.12.0
3.12.1
3.12.2
3.13.0
3.13.1
3.13.2
3.13.3
3.14.0
3.14.1
3.14.2
3.14.3
3.14.4
3.14.5
3.14.6
3.14.7
3.15.0
3.2.0
3.3.0
3.4.0
3.4.1
3.4.2
3.5.0
3.5.1
3.5.2
3.6.0
3.6.1
3.6.10
3.6.11
3.6.2
3.6.3
3.6.4
3.6.5
3.6.6
3.6.7
3.6.8
3.6.9
3.7.0
3.7.1
3.7.2
3.7.3
3.8.0
3.8.1
3.9.0
3.9.1
3.9.2
3.9.3
3.9.4
4.*
4.0.0
4.0.3
4.0.4
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.1
4.10.2
4.10.3
4.11.0
4.11.1
4.12.0
4.12.1
4.12.2
4.2.0
4.2.1
4.3.0
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.6.0
4.7.0
4.7.1
4.8.0
4.8.1
4.8.2
4.8.3
4.8.6
4.8.7
4.9.0
4.9.1
5.*
5.0.0
5.0.0-rc1
5.0.0rc2
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.2.0
5.2.1
6.*
6.0.0
6.0.0b1
6.0.0b2
6.0.0b3
6.0.0b5
6.0.1
6.2.0
6.2.1
6.3.0
6.3.1
6.3.2
6.3.3rc
6.4.0
6.4.1
6.4.2
6.4.3
6.5.0
6.5.2
6.6.0
6.6.1
6.7.0
6.7.1
7.*
7.0.0
7.0.0a1
7.0.0a2
7.0.0a3
7.0.0a4
7.0.0a5
7.0.0b1
7.0.1
7.0.10
7.0.11
7.0.12
7.0.2
7.0.3
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.3.1
7.3.2
7.4.1
7.4.2
7.4.3
7.4.4
7.4.5
7.4.6
7.4.7
7.5.0
7.5.1
7.5.2
7.6.0
7.7.0
7.7.1
7.7.2
7.7.3
7.7.4
7.7.5
7.7.6
7.7.7

Database specific

vanir_signatures_modified 
"2026-08-02T09:08:28Z"
vanir_signatures 
[
    {
        "signature_type": "Line",
        "target": {
            "file": "thumbor/ext/filters/_convolution.c"
        },
        "deprecated": false,
        "source": "https://github.com/thumbor/thumbor/commit/447e192e3fb92e64c12e5354a56a4a7133f69d73",
        "id": "CVE-2026-53503-1d1ba0c2",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "331860887079222848408616751728650524390",
                "102845713418915347401106561625760000959",
                "141057370814210221605386325158426071900",
                "327776404604771883483459886814002358669"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "thumbor/ext/filters/_convolution.c",
            "function": "_convolution_apply"
        },
        "deprecated": false,
        "source": "https://github.com/thumbor/thumbor/commit/447e192e3fb92e64c12e5354a56a4a7133f69d73",
        "id": "CVE-2026-53503-38b415f2",
        "signature_version": "v1",
        "digest": {
            "function_hash": "71343731735558916145751808373970799556",
            "length": 1828.0
        }
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53503.json"