CVE catalog

CVE-2026-53503

UBUNTU-CVE-2026-53503

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.75% · Oct 25, 2026

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution(<matrix>, <columns>, <should_normalize>) filter passes the user-controlled <columns> value to a C extension (thumbor/ext/filters/_convolution.c) where it is used as a divisor (for % and /) without validating columns > 0. When columns=0, the C code triggers undefined behavior; on x86_64 this reliably results in a fatal divide-by-zero trap (SIGFPE) and crashes the Thumbor process, causing a remote denial of service. This issue is fixed in 7.8.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianthumbor146.3.2-3vulnerable
Debianthumbor146.3.2-4vulnerable
Debianthumbor146.5.1-1vulnerable
Debianthumbor146.5.1-2vulnerable
Debianthumbor146.5.1-3vulnerable
Debianthumbor146.5.1-4vulnerable
Debianthumbor146.5.1-5vulnerable
Debianthumbor146.5.1-6vulnerable
Debianthumbor146.5.1-7vulnerable
Debianthumbor146.7.0-1vulnerable
Debianthumbor147.7.7-1vulnerable
Debianthumbor147.7.7-2vulnerable
Debianthumbor147.7.7-3vulnerable
Debianthumbor147.7.7-4vulnerable
Debianthumbor147.7.7-5vulnerable
Debianthumbor147.7.7-6vulnerable
Debianthumbor147.8.0-1fixed
Ubuntuthumbor26.047.7.7-4vulnerable
Ubuntuthumbor26.047.7.7-5vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianthumbordeb147.8.0-1Not reportedDEBIAN-CVE-2026-53503Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database]