Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion(<value>) filter does not enforce an upper bound on …

Thumbor, an open-source photo thumbnail service by globo.com, contains a denial-of-service vulnerability in its filters:proportion(<value>) filter. Prior to version 7.8.0, the filter does not enforce an upper bound on the provided value and executes during the post-transform phase. An attacker can exploit this by supplying extremely large values, triggering massive image resize operations that exhaust CPU and memory resources. This results in a denial-of-service condition affecting the availability of the service. The vulnerability requires no authentication and can be triggered remotely by manipulating filter parameters. The issue has been resolved in Thumbor version 7.8.0, which enforces an upper bound on the proportion filter value. Users are advised to upgrade immediately to mitigate the risk.