CyberRota Analysis
AI-GeneratedThumbor versions prior to 7.8.0 are vulnerable to a denial-of-service attack due to improper validation of user-controlled input in the convolution filter, specifically when the <columns> parameter is set to zero. This oversight leads to a divide-by-zero error, causing the Thumbor process to crash. Organizations using affected versions of Thumbor should prioritize upgrading to 7.8.0 to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution(<matrix>, <columns>, <should_normalize>) filter passes the user-controlled <columns> value to a C extension (thumbor/ext/filters/_convolution.c) where it is used as a divisor (for % and /) without validating columns > 0. When columns=0, the C code triggers undefined behavior; on x86_64 this reliably results in a fatal divide-by-zero trap (SIGFPE) and crashes the Thumbor process, causing a remote denial of service. This issue is fixed in 7.8.0.