CVE-2026-53505 Details

A denial-of-service vulnerability has been identified in Thumbor, an open-source photo thumbnail service, in versions prior to 7.8.0. The issue arises in the 'filters:proportion(<value>)' filter, which does not impose an upper limit on the '<value>' parameter and operates in the post-transform phase. This allows attackers to specify excessively large resize values, leading to CPU and memory exhaustion. The vulnerability can cause a process crash or an out-of-memory kill, creating a remote denial-of-service condition when unsafe URLs are enabled or when a valid signed URL can be obtained.

Users are advised to upgrade to Thumbor version 7.8.0, which includes a fix for this vulnerability by capping the proportion value to prevent denial-of-service conditions.