CVE-2026-53503

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution(<matrix>, <columns>, <should_normalize>) filter passes the user-controlled <columns> value to a C extension (thumbor/ext/filters/_convolution.c) where it is used as a divisor (for % and /) without validating columns > 0. When columns=0, the C code triggers undefined behavior; on x86_64 this reliably results in a fatal divide-by-zero trap (SIGFPE) and crashes the Thumbor process, causing a remote denial of service. This issue is fixed in 7.8.0.

• CWE-20
• CWE-369

• https://github.com/thumbor/thumbor/commit/447e192e3fb92e64c12e5354a56a4a7133f69d73
• https://github.com/thumbor/thumbor/releases/tag/7.8.0
• https://github.com/thumbor/thumbor/security/advisories/GHSA-cqjp-jf4r-h5q9
• https://github.com/thumbor/thumbor/security/advisories/GHSA-cqjp-jf4r-h5q9

Published

Jul 31, 2026

Last Modified

Jul 31, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5349A vulnerability was identified in Trendnet TEW-657BRM 1.00.1…8.8
• CVE-2026-53492containerd is an open-source container runtime. In Versions …9.6
• CVE-2026-5350A security flaw has been discovered in Trendnet TEW-657BRM 1…8.8
• CVE-2026-53500Thumbor is an open-source photo thumbnail service by globo.c…8.2
• CVE-2026-53501Thumbor is an open-source photo thumbnail service by globo.c…8.2
• CVE-2026-53502Thumbor is an open-source photo thumbnail service by globo.c…8.7
• CVE-2026-53504Thumbor is an open-source photo thumbnail service by globo.c…7.5
• CVE-2026-53505Thumbor is an open-source photo thumbnail service by globo.c…7.5
• CVE-2026-5351A weakness has been identified in Trendnet TEW-657BRM 1.00.1…8.8
• CVE-2026-53510Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon:…8.1
• CVE-2026-53511calibre is an e-book manager. Prior to 9.10.0, a malicious E…8.5
• CVE-2026-53512Better Auth is an authentication and authorization library f…9.1