CVE-2026-53505: Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS

July 31, 2026

Thumbor’s filters:proportion(<value>) filter does not enforce an upper bound on <value> and runs in the post-transform phase. An attacker can trigger extremely large resizes (CPU/memory exhaustion) and cause denial of service.

References

github.com/advisories/GHSA-phj3-59pf-cp83
github.com/thumbor/thumbor/commit/2c716119de986cfc68c7071af52a98187e006023
github.com/thumbor/thumbor/releases/tag/7.8.0
github.com/thumbor/thumbor/security/advisories/GHSA-phj3-59pf-cp83
nvd.nist.gov/vuln/detail/CVE-2026-53505

Code Behaviors & Features

Detect and mitigate CVE-2026-53505 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →