The Thumbor image processing service's 'filters:proportion(<value>)' filter does not enforce an upper bound on the <value> parameter, which is parsed as a float and used to compute new image dimensions during the post-transform phase. This allows an attacker to request extremely large image resizes, causing CPU and memory exhaustion and resulting in a remote denial of service. The filter runs after the main transform pipeline, bypassing earlier size clamping protections. Exploitation is possible if unsafe URLs are enabled or if the attacker has a valid signed URL. The vulnerability affects Thumbor versions before 7.8.0. A fix is available to enforce strict bounds on the proportion parameter as per documentation.

This vulnerability enables remote denial of service by exhausting server CPU and memory resources through unbounded image resizing. If unsafe URLs are enabled, unauthenticated attackers can exploit this. Otherwise, exploitation requires a valid signed URL, limiting risk to authorized users or those with access to signed URLs. The attack can cause process crashes or out-of-memory kills, impacting service availability.

A patch is available that enforces strict bounds on the 'proportion' filter parameter, limiting it to values between 0.0 and 1.0 as documented. Deployers should upgrade to Thumbor version 7.8.0 or later. If upgrading is not immediately possible, ensure that unsafe URLs are disabled and that signed URLs are tightly controlled to reduce exposure.