An unauthenticated remote denial-of-service vulnerability in Thumbor allows attackers to crash the service via improper input validation.

This issue stems from improper input validation (CWE-20) that triggers a divide-by-zero error (CWE-369) during image processing. This allows an unauthenticated remote attacker to disrupt service availability by sending specifically crafted requests.

Successful exploitation results in a denial-of-service, which can cause significant disruption to web services relying on Thumbor for image delivery. While the impact is limited to availability, the ease of automation for this attack justifies the 7.5 CVSS score and necessitates prompt patching.

Immediate Action: Update the Thumbor package to version 7.8.0 or later to address the input validation flaw.

Proactive Monitoring: Monitor service uptime and error logs for frequent service crashes or high rates of 500-series errors during image processing tasks.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter out malformed requests or unusual input patterns directed at the image processing endpoints.

Public Exploit Available: Unknown

Administrators should update their Thumbor instances to version 7.8.0 immediately to restore service stability. Prioritize this update if Thumbor is a critical component of your public-facing web infrastructure.