THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-cqjp-jf4r-h5q9 (high) — Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS

[GHSA] GHSA-cqjp-jf4r-h5q9 (high) — Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS

medgithub_advisoriesPublished 2026-07-31

GHSA-cqjp-jf4r-h5q9 Severity: high CVE: CVE-2026-53503

Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS

### Summary Thumbor's `filters:convolution(<matrix>, <columns>, <should_normalize>)` filter passes the user-controlled `<columns>` value to a C extension (`thumbor/ext/filters/_convolution.c`) where it is used as a divisor (for `%` and `/`) without validati

Indicators of compromise

Original source: https://github.com/advisories/GHSA-cqjp-jf4r-h5q9