CVE-2026-53503: Thumbor divide by zero in convolution filter C extension

CVE-2026-53503 · Severity: high · CVSS 7.5 · Published 2026-07-31

Thumbor, an open-source photo processing service used to generate image thumbnails, is vulnerable to a flaw that allows remote attackers to crash the service. By providing a specific invalid value to the image convolution filter, an attacker can trigger a fatal error in the application's underlying code. This results in a denial of service, preventing the system from processing images for legitimate users and potentially impacting website performance or availability.

Technologies: thumbor (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-53503 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-53503 being exploited in the wild.
How severe is CVE-2026-53503?
High severity, with a CVSS score of 7.5, published 31 July 2026.
Which products and versions are affected?
thumbor (PyPI) <= 7.7.7, ECOSYSTEM:introduced=0,fixed=7.8.0.
Is there a fix for CVE-2026-53503?
Yes. thumbor (PyPI): upgrade to 7.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53503 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-53503?
Check whether you run thumbor (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • thumbor (PyPI): upgrade to 7.8.0 or later
    pip install "thumbor>=7.8.0"

Technical details

A divide-by-zero vulnerability (CWE-369) exists in Thumbor's convolution filter C extension (thumbor/ext/filters/_convolution.c). The Python entry point for the 'filters:convolution' method uses 'BaseFilter.PositiveNumber', which incorrectly allows a value of 0 for the 'columns' parameter. This value is passed to the native C extension and used as a divisor in modulo and division operations without validation. On x86_64 architectures, this triggers a SIGFPE (fatal arithmetic exception), crashing the Thumbor process. The vulnerability is exploitable remotely via unauthenticated requests if '/unsafe/' URLs are enabled, or via signed URLs if they are not. The issue is resolved in version 7.8.0 by enforcing 'PositiveNonZeroNumber' in the Python layer and adding validation guards in the C extension.

Affected products

  • globo.com thumbor < 7.8.0

Identifiers

  • CVE-2026-53503
  • GHSA-cqjp-jf4r-h5q9
  • PYSEC-2026-3619

Timeline

  • 2023-05-30: patched: Version 7.8.0 released
  • 2026-06-10: advisory: GitHub Security Advisory published
  • 2026-07-31: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.