Listen to this Post
Thumbor’s `filters:convolution(thumbor/ext/filters/_convolution.c) where it is used as a divisor (for `%` and /) without validating columns > 0. The Python filter entry point allows `columns=0` because `BaseFilter.PositiveNumber` matches `”0″` via the regex r"[\d]+". The C extension then divides/modulos by `columns_count` without a zero check:
kernel_size = PyTuple_Size(kernel_tuple);
if ((kernel_size % columns_count != 0) ||
(kernel_size % 2 == 0) ||
((kernel_size / columns_count) % 2) == 0) {
return NULL;
}
When columns=0, the C code triggers undefined behavior; on x86_64 this reliably results in a fatal divide-by-zero trap (SIGFPE) and crashes the Thumbor process (confirmed on Linux x86_64 and macOS Intel x86_64), causing a remote denial of service. The `convolution` filter is enabled by default via BUILTIN_FILTERS. If `/unsafe/` URLs are allowed (ALLOW_UNSAFE_URL=True), the attack is unauthenticated and remotely exploitable; if `/unsafe/` is disabled, the attacker needs a valid signed URL. This issue is fixed in version 7.8.0. The vulnerability is associated with CWE-20 (Improper Input Validation) and CWE-369 (Divide By Zero), with a CVSS 3.1 base score of 7.5 (HIGH).
DailyCVE Form:
Platform: Thumbor
Version: < 7.8.0
Vulnerability: Divide-by-zero (SIGFPE)
Severity: HIGH (CVSS 7.5)
date: 2026-07-31
Prediction: 2026-05-30 (7.8.0 release)
What Undercode Say:
The vulnerability stems from inadequate input validation at both the Python regex layer and the C extension layer. `BaseFilter.PositiveNumber` accepts zero, and the C code lacks a `columns_count <= 0` check before division/modulo operations. The fix requires rejecting `columns_count <= 0` in `_convolution.c` and using `BaseFilter.PositiveNonZeroNumber` in convolution.py. The Thumbor 7.8.0 release includes this fix along with other denial-of-service fixes. Administrators running Thumbor in production are strongly encouraged to upgrade. The vulnerability is remotely exploitable with low attack complexity and no privileges required.
Exploit:
Example request (/unsafe/ enabled - unauthenticated) curl "http://<host>:<port>/unsafe/400x400/filters:convolution(1;2;1;2;4;2;1;2;1,0,true)/example.jpg" Example request (signed URL - requires valid signature) curl "http://<host>:<port>/<url-sign>/400x400/filters:convolution(1;2;1;2;4;2;1;2;1,0,true)/example.jpg"
Protection:
- Upgrade Thumbor to version 7.8.0 or later.
- If unable to upgrade immediately, apply the following patches:
- In
thumbor/ext/filters/_convolution.c: reject `columns_count <= 0` before any `%` or `/` operation. - In
thumbor/filters/convolution.py: change the filter parameter from `BaseFilter.PositiveNumber` toBaseFilter.PositiveNonZeroNumber. - Consider disabling the `convolution` filter via configuration if not required, or restrict `/unsafe/` endpoint access.
Impact:
- Remote Denial of Service via process crash (SIGFPE) on x86_64 architectures.
- If `/unsafe/` is enabled: unauthenticated remote DoS.
- If `/unsafe/` is disabled: the attacker needs a valid signed URL (authorized user/partner, or can obtain signed URLs from a trusted signing service).
- No confidentiality or integrity impact; availability impact is HIGH.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
