Executive brief
Thumbor, an open-source photo thumbnail service, is vulnerable to a denial-of-service attack. By requesting an image with an extremely large proportion value, an attacker can force the server to consume excessive CPU and memory resources. This can lead to service outages, slow performance for legitimate users, or complete system crashes.
Technical details
A vulnerability exists in Thumbor's 'filters:proportion(<value>)' implementation where the input value is parsed as an unbounded float. Because this filter executes during the POST_TRANSFORM phase, it bypasses standard request-level size clamping (such as MAX_WIDTH and MAX_HEIGHT). An attacker can provide a large value (e.g., 10000) to trigger an arbitrarily large resize operation, leading to CPU and memory exhaustion. This is exploitable via unauthenticated network requests if 'unsafe' URLs are enabled, or by any user capable of generating or obtaining a valid signed URL. The issue is resolved in version 7.8.0 by enforcing a strict bound on the proportion parameter.
Affected products
- thumbor thumbor <= 7.7.7
Timeline
- 2026-05-30: patched: Version 7.8.0 released
- 2026-06-10: advisory: GitHub Security Advisory published
- 2026-07-31: disclosed: CVE published to NVD