CVE-2026-53505

Thumbor (open-source photo thumbnail service by globo.com) is affected prior to version 7.8.0. The filters:proportion() function does not enforce an upper bound on and executes during the post-transform phase, enabling extremely large resizes that can exhaust CPU/memory and cause a denial of ser...

CVE-2026-53505: Uncontrolled Resource Consumption

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion filter does not enforce an upper bound on and runs in the post-transform phase. An attacker can trigger extremely large resizes CPU/memory exhaustion and cause denial of service. This issu...