EUVD-2026-51609
GHSA-cqjp-jf4r-h5q9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request with columns=0
-
DeliveryPython PositiveNumber regex accepts zero
-
ExploitZero passed to C extension _convolution.c
-
ExecutionInteger divide-by-zero triggers SIGFPE
-
ImpactThumbor process crashes causing remote DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | The convolution filter must be enabled - it is present by default in BUILTIN_FILTERS, so no special configuration is required to expose the attack surface. Exploitation follows one of two paths based on deployment: if ALLOW_UNSAFE_URL=True (a common configuration in internal or development environments), any unauthenticated remote attacker can send the malicious request with no credentials or prior access. If unsafe URLs are disabled, the attacker must possess a valid HMAC-signed URL, meaning they must be an authorized API consumer, a trusted integration partner, or able to extract signing credentials from a legitimate client. The crash is confirmed on Linux x86_64 and macOS Intel x86_64; exploitation on ARM or non-x86 architectures is not confirmed in the advisory and may differ. No exploitation path exists if the convolution filter is explicitly removed from BUILTIN_FILTERS. |
| Impact | The provided CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects the worst-case deployment where ALLOW_UNSAFE_URL=True, enabling fully unauthenticated exploitation - any internet-reachable Thumbor instance in this mode can be crashed with one HTTP request. For deployments with unsafe URLs disabled (signed URLs required), the effective CVSS would be closer to 6.5 (PR:L), as the attacker must hold a valid signed URL or be an authorized user. No EPSS data was provided, and this vulnerability is not in CISA KEV, meaning automated or widespread exploitation has not been confirmed. However, the PoC is published in the vendor's own security advisory and requires no specialized knowledge - one-shot, low-friction exploitation means the practical risk is higher than the absence of KEV suggests. The impact is limited strictly to availability (no confidentiality or integrity exposure), but a complete process crash with no self-recovery makes this a meaningful operational risk for image-serving infrastructure. Priority should be calibrated by whether unsafe URLs are enabled: high-urgency for permissive deployments, moderate-urgency where signed URLs are enforced. |
| Exploit ScenarioDerived | A publicly available PoC is documented in the GHSA advisory. An attacker sends a single HTTP GET request - for example, GET /unsafe/400x400/filters:convolution(1;2;1;2;4;2;1;2;1,0,true)/example.jpg - to a Thumbor instance where ALLOW_UNSAFE_URL=True. The convolution filter parses columns=0, the C extension performs integer division by zero, SIGFPE is raised, and the Thumbor worker process terminates immediately, denying image processing service to all users. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Remote denial of service in Thumbor's convolution filter (versions <= 7.7.7) allows an attacker to crash the Thumbor worker process with a single crafted HTTP request by passing columns=0 to the filters:convolution() URL parameter. The Python-layer input validation accepts zero via an overly permissive regex (PositiveNumber matches '0'), which propagates to a C extension that performs integer division by zero, triggering SIGFPE and killing the process on x86_64 Linux and macOS Intel. No public exploit identified at time of analysis per KEV, but a fully functional proof-of-concept is documented in the vendor's own GHSA advisory, making exploitation trivially reproducible.
RemediationAI
Upgrade to thumbor 7.8.0 or later (pip install 'thumbor>=7.8.0') - this is the vendor-released patch confirmed by commit 447e192e3fb92e64c12e5354a56a4a7133f69d73 and the release at https://github.com/thumbor/thumbor/releases/tag/7.8.0. The fix applies two complementary defenses: the Python filter now requires BaseFilter.PositiveNonZeroNumber (regex [\d]*[1-9][\d]*), rejecting zero at URL parse time, and the C extension adds an explicit columns_count <= 0 guard before any division. If upgrading immediately is not possible, the highest-impact workaround is to remove the convolution filter from BUILTIN_FILTERS in thumbor.conf - this eliminates the attack surface entirely but disables convolution image processing for all users. A secondary mitigation is to set ALLOW_UNSAFE_URL=False and enforce signed URLs, which raises the bar from unauthenticated to authenticated exploitation but does not eliminate the vulnerability for authorized users. These workarounds should be treated as temporary bridges to patching, not permanent controls.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Thumbor is a Python-based smart image processing server distributed as a pip package (pkg:pip/thumbor). The convolution filter accepts a matrix, column count, and normalization flag via URL, e.g. filters:convolution(matrix,columns,normalize). The Python entry point in thumbor/filters/convolution.py uses BaseFilter.PositiveNumber - defined as regex [\d]+ - to parse the columns argument. This regex matches '0', and the parsed integer zero is forwarded to the native C extension at thumbor/ext/filters/_convolution.c. In the C code, columns_count is used directly as a divisor in both modulo and division expressions without any guard for columns_count <= 0. On x86_64, this triggers an integer divide-by-zero, which the OS delivers as SIGFPE, fatally terminating the process. The root cause is CWE-20 (Improper Input Validation): the existing PositiveNonZeroNumber type (regex [\d]*[1-9][\d]*) was available and correct, but the wrong variant was used at the filter's parameter declaration.
Know when Python gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable with no privileges when unsafe URLs enabled; pure availability impact with no confidentiality or integrity exposure.
Primary rating from Vendor (https://github.com/thumbor/thumbor).
CVSS VectorVendor: https://github.com/thumbor/thumbor
DescriptionCVE.org
Summary
Thumbor's filters:convolution(<matrix>, <columns>, <should_normalize>) filter passes the user-controlled <columns> value to a C extension (thumbor/ext/filters/_convolution.c) where it is used as a divisor (for % and /) without validating columns > 0. When columns=0, the C code triggers undefined behavior; on x86_64 this reliably results in a fatal divide-by-zero trap (SIGFPE) and crashes the Thumbor process (confirmed on Linux x86_64 and macOS Intel x86_64), causing a remote denial of service.
Details
Root cause
The Python filter accepts columns=0, and the native C extension uses columns_count as a divisor without validating it.
- Python filter entry point allows
columns=0(thumbor/filters/convolution.py):
@filter_method(
r"(?:[-]?[\d]+\.?[\d]*[;])*(?:[-]?[\d]+\.?[\d]*)",
BaseFilter.PositiveNumber,
# accepts 0
BaseFilter.Boolean,
)
async def convolution(self, matrix, columns, should_normalize=True):
...
imgdata = _convolution.apply(..., matrix, columns, should_normalize)BaseFilter.PositiveNumber matches "0" (thumbor/filters/__init__.py):
class BaseFilter:
PositiveNumber = {"regex": r"[\d]+", "parse": int}
# matches "0"
PositiveNonZeroNumber = {"regex": r"[\d]*[1-9][\d]*", "parse": int}- C extension divides/modulos by
columns_countwithout a zero check (thumbor/ext/filters/_convolution.c):
kernel_size = PyTuple_Size(kernel_tuple);
if ((kernel_size % columns_count != 0) ||
(kernel_size % 2 == 0) ||
((kernel_size / columns_count) % 2) == 0) {
// TODO: error, not a valid kernel
return NULL;
}PoC
Test environment
- Linux x86_64
Preconditions
- The
convolutionfilter is enabled (it is enabled by default viaBUILTIN_FILTERS). - Either:
/unsafe/URLs are allowed (ALLOW_UNSAFE_URL=True), OR/unsafe/is disabled, and the attacker has a valid signed URL (i.e., the attacker is an authorized user/partner, or can obtain signed URLs from a trusted signing service).
Example request (signed URL)
http://<host>:<port>/<url-sign>/400x400/filters:convolution(1;2;1;2;4;2;1;2;1,0,true)/example.jpg
Example request (/unsafe/)
http://<host>:<port>/unsafe/400x400/filters:convolution(1;2;1;2;4;2;1;2;1,0,true)/example.jpg
Impact
- Remote Denial of Service via process crash (SIGFPE) on x86_64 (confirmed on Linux x86_64 and macOS Intel x86_64).
- Exploitability depends on deployment:
- If
/unsafe/is enabled: unauthenticated remote DoS. - If
/unsafe/is disabled: the attacker needs a valid signed URL.(i.e., the attacker is an authorized user/partner, or can obtain signed URLs from a trusted signing service)
Suggested remediation
- In the C extension (
thumbor/ext/filters/_convolution.c): - Reject
columns_count <= 0before any%or/. - In the Python filter (
thumbor/filters/convolution.py): - Require
columnsto be non-zero (e.g., useBaseFilter.PositiveNonZeroNumber).
Blast Radius
ecosystem impact- 24 pypi packages depend on thumbor (24 direct, 0 indirect)
Ecosystem-wide dependent count for version 7.8.0.
Articles & Coverage 1
Executive ViewAI
Thumbor image processing services running versions 7.7.7 or earlier face a remote denial of service vulnerability that could disrupt image delivery and dependent web operations. Publicly available exploit code exists, enabling attackers to crash Thumbor workers with a single HTTP request, significantly increasing exploitation likelihood. All organizations operating affected versions require immediate patches to restore service reliability.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Exploit-DB