Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS (CVE-2026-53505)
### Summary Thumbor's `filters:proportion(<value>)` filter does not enforce an upper bound on `<value>` and runs in the post-transform phase. An attacker can trigger extremely large resizes (CPU/memory exhaustion) and cause denial of service. ### Details - Filter implementation: `thumbor/filters/proportion.py` - `value` is parsed as a float (`BaseFilter.DecimalNumber`) with no maximum. - The filter computes `new_width = source_width * value` and `new_height = source_height * value` and then calls `engine.resize(new_width, new_height)`. - Execution phase: `proportion` runs in the default POST_TRANSFORM phase (after the main transform pipeline). This means it can effectively bypass request-level size clamping that happens earlier in the request lifecycle (e.g., `MAX_WIDTH`/`MAX_HEIGHT` applied to `req.width/req.height`). Documentation states the `percentage` argument should be `0.0 to 1.0` (`docs/proportion.rst`), but the implementation does not enforce this constraint. ### PoC #### Preconditions - The `proportion` filter is enabled (it is enabled by default via `BUILTIN_FILTERS`). - Either: - `/unsafe/` URLs are allowed (`ALLOW_UNSAFE_URL=True`, common default in some deployments), OR - `/unsafe/` is disabled, and the attacker has a valid signed URL (i.e., the attacker is an authorized user/partner, or otherwise can obtain signed URLs issued by a trusted signing service). #### Example request 1 (signed URL) The following request was used to reproduce the issue and causes severe resource exhaustion: `http://<host>:<port>/<url-sign>/100x100/filters:proportion(10000)/example.jpg` #### Example request 2 (/unsafe/) If `/unsafe/` is enabled: `http://<host>:<port>/unsafe/100x100/filters:proportion(10000)/example.jpg` ### Impact - Remote Denial of Service via CPU and/or memory exhaustion (and potentially process crash / OOM kill). - Exploitability depends on deployment: - If `/unsafe/` is enabled: unauthenticated remote DoS. - If `/unsafe/` is disabled: the attacker needs a valid signed URL (i.e., the attacker can legitimately request signed URLs, or has access to signed URLs issued for other users/partners). If signed URLs are not exposed to untrusted parties, exploitability is reduced but the risk still applies to any party who can generate/use signed URLs. ### Suggested remediation - Enforce a strict bound on the `proportion` parameter (e.g., `0.0 < value <= 1.0` as documented), or define a safe maximum based on intended semantics.
AI Analysis
Technical Summary
The Thumbor image processing service's 'filters:proportion(<value>)' filter does not enforce an upper bound on the <value> parameter, which is parsed as a float and used to compute new image dimensions during the post-transform phase. This allows an attacker to request extremely large image resizes, causing CPU and memory exhaustion and resulting in a remote denial of service. The filter runs after the main transform pipeline, bypassing earlier size clamping protections. Exploitation is possible if unsafe URLs are enabled or if the attacker has a valid signed URL. The vulnerability affects Thumbor versions before 7.8.0. A fix is available to enforce strict bounds on the proportion parameter as per documentation.
Potential Impact
This vulnerability enables remote denial of service by exhausting server CPU and memory resources through unbounded image resizing. If unsafe URLs are enabled, unauthenticated attackers can exploit this. Otherwise, exploitation requires a valid signed URL, limiting risk to authorized users or those with access to signed URLs. The attack can cause process crashes or out-of-memory kills, impacting service availability.
Mitigation Recommendations
A patch is available that enforces strict bounds on the 'proportion' filter parameter, limiting it to values between 0.0 and 1.0 as documented. Deployers should upgrade to Thumbor version 7.8.0 or later. If upgrading is not immediately possible, ensure that unsafe URLs are disabled and that signed URLs are tightly controlled to reduce exposure.
Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS (CVE-2026-53505)
Description
### Summary Thumbor's `filters:proportion(<value>)` filter does not enforce an upper bound on `<value>` and runs in the post-transform phase. An attacker can trigger extremely large resizes (CPU/memory exhaustion) and cause denial of service. ### Details - Filter implementation: `thumbor/filters/proportion.py` - `value` is parsed as a float (`BaseFilter.DecimalNumber`) with no maximum. - The filter computes `new_width = source_width * value` and `new_height = source_height * value` and then calls `engine.resize(new_width, new_height)`. - Execution phase: `proportion` runs in the default POST_TRANSFORM phase (after the main transform pipeline). This means it can effectively bypass request-level size clamping that happens earlier in the request lifecycle (e.g., `MAX_WIDTH`/`MAX_HEIGHT` applied to `req.width/req.height`). Documentation states the `percentage` argument should be `0.0 to 1.0` (`docs/proportion.rst`), but the implementation does not enforce this constraint. ### PoC #### Preconditions - The `proportion` filter is enabled (it is enabled by default via `BUILTIN_FILTERS`). - Either: - `/unsafe/` URLs are allowed (`ALLOW_UNSAFE_URL=True`, common default in some deployments), OR - `/unsafe/` is disabled, and the attacker has a valid signed URL (i.e., the attacker is an authorized user/partner, or otherwise can obtain signed URLs issued by a trusted signing service). #### Example request 1 (signed URL) The following request was used to reproduce the issue and causes severe resource exhaustion: `http://<host>:<port>/<url-sign>/100x100/filters:proportion(10000)/example.jpg` #### Example request 2 (/unsafe/) If `/unsafe/` is enabled: `http://<host>:<port>/unsafe/100x100/filters:proportion(10000)/example.jpg` ### Impact - Remote Denial of Service via CPU and/or memory exhaustion (and potentially process crash / OOM kill). - Exploitability depends on deployment: - If `/unsafe/` is enabled: unauthenticated remote DoS. - If `/unsafe/` is disabled: the attacker needs a valid signed URL (i.e., the attacker can legitimately request signed URLs, or has access to signed URLs issued for other users/partners). If signed URLs are not exposed to untrusted parties, exploitability is reduced but the risk still applies to any party who can generate/use signed URLs. ### Suggested remediation - Enforce a strict bound on the `proportion` parameter (e.g., `0.0 < value <= 1.0` as documented), or define a safe maximum based on intended semantics.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Thumbor image processing service's 'filters:proportion(<value>)' filter does not enforce an upper bound on the <value> parameter, which is parsed as a float and used to compute new image dimensions during the post-transform phase. This allows an attacker to request extremely large image resizes, causing CPU and memory exhaustion and resulting in a remote denial of service. The filter runs after the main transform pipeline, bypassing earlier size clamping protections. Exploitation is possible if unsafe URLs are enabled or if the attacker has a valid signed URL. The vulnerability affects Thumbor versions before 7.8.0. A fix is available to enforce strict bounds on the proportion parameter as per documentation.
Potential Impact
This vulnerability enables remote denial of service by exhausting server CPU and memory resources through unbounded image resizing. If unsafe URLs are enabled, unauthenticated attackers can exploit this. Otherwise, exploitation requires a valid signed URL, limiting risk to authorized users or those with access to signed URLs. The attack can cause process crashes or out-of-memory kills, impacting service availability.
Mitigation Recommendations
A patch is available that enforces strict bounds on the 'proportion' filter parameter, limiting it to values between 0.0 and 1.0 as documented. Deployers should upgrade to Thumbor version 7.8.0 or later. If upgrading is not immediately possible, ensure that unsafe URLs are disabled and that signed URLs are tightly controlled to reduce exposure.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-phj3-59pf-cp83
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-53505"]
- Ecosystems
- ["PyPI"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a6d13b0bf32cb7a3458012c
Added to database: 07/31/2026, 21:29:20 UTC
Last enriched: 07/31/2026, 21:32:59 UTC
Last updated: 09/12/2026, 22:01:34 UTC
Views: 66
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.