CVE-2026-53503 — Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS

Affected: thumbor

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution(<matrix>, <columns>, <should_normalize>) filter passes the user-controlled <columns> value to a C extension (thumbor/ext/filters/_convolution.c) where it is used as a divisor (for % and /) without validating columns > 0. When columns=0, the C code triggers undefined behavior; on x86_64 this reliably results in a fatal divide-by-zero trap (SIGFPE) and crashes the Thumbor process, causing a remote denial of service. This issue is fixed in 7.8.0.

PYSEC-2026-3619 — Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS

Affected: PyPI: thumbor

### Summary Thumbor's `filters:convolution(<matrix>, <columns>, <should_normalize>)` filter passes the user-controlled `<columns>` value to a C extension (`thumbor/ext/filters/_convolution.c`) where it is used as a divisor (for `%` and `/`) without validating `columns > 0`. When `columns=0`, the C code triggers undefined behavior; on x86_64 this reliably results in a fatal divide-by-zero trap (SIGFPE) and crashes the Thumbor process (confirmed on Linux x86_64 and macOS Intel x86_64), causing a remote denial of service.

### Details #### Root cause The Python filter accepts `columns=0`, and the native C extension uses `columns_count` as a divisor without validating it.

1) Python filter entry point allows `columns=0` (`thumbor/filters/convolution.py`): ```python @filter_method( r"(?:[-]?[\d]+\.?[\d]*[;])*(?:[-]?[\d]+\.?[\d]*)", BaseFilter.PositiveNumber, # accepts 0 BaseFilter.Boolean, ) async def convolution(self, matrix, columns, should_normalize=True): ... imgdata = _convolution.apply(..., matrix, columns, should_normalize) ``` `BaseFilter.PositiveNumber` matches `"0"` (`thumbor/filters/__init__.py`): ```python class BaseFilter: PositiveNumber = {"regex": r"[\d]+", "parse": int} # matches "0" PositiveNonZeroNumber = {"regex": r"[\d]*[1-9][\d]*", "parse": int} ```

2) C extension divides/modulos by `columns_count` without a zero check (`thumbor/ext/filters/_convolution.c`): ```c kernel_size = PyTuple_Size(kernel_tuple); if ((kernel_size % colum…

Most recent entries from all

CVE-2026-53503 — Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS

PYSEC-2026-3619 — Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS