Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution(<matrix>, <columns>, <should_normalize>) filter pa…

A divide-by-zero vulnerability exists in Thumbor, an open-source photo thumbnail service by globo.com, prior to version 7.8.0. The filters:convolution() filter passes a user-controlled 'columns' parameter directly to a C extension (_convolution.c) without validating that the value is greater than zero. When columns=0 is supplied, the C code triggers undefined behavior resulting in a fatal SIGFPE (divide-by-zero trap) on x86_64 systems. This reliably crashes the Thumbor process, enabling remote denial of service by any unauthenticated user able to craft a malicious image request. The vulnerability resides in the native C extension layer, making it a reliable crash rather than a graceful error. The issue has been patched in Thumbor version 7.8.0 with input validation added to ensure columns > 0 before use as a divisor.