DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-53504: CVE-2026-53504: Regular Expression Denial of Service (ReDoS) in Thumbor Convolution Filter

#security #cve #cybersecurity

CVE-2026-53504: Regular Expression Denial of Service (ReDoS) in Thumbor Convolution Filter

Vulnerability ID: CVE-2026-53504
CVSS Score: 7.5
Published: 2026-07-31

A critical Regular Expression Denial of Service (ReDoS) vulnerability exists in Thumbor prior to version 7.8.0. The vulnerability resides within the dynamic filter-parsing engine, specifically inside the 'convolution' filter parameter processing logic. Due to overlapping and nested quantifiers in the regular expression used to parse matrix values, a remote, unauthenticated attacker can supply a specially crafted, malformed filter payload inside a request URL. This causes Python's standard NFA-based regular expression engine to undergo exponential backtracking, exhausting CPU resources and leading to a complete Denial of Service.

TL;DR

Unauthenticated remote attackers can trigger exponential CPU backtracking in Thumbor (< 7.8.0) via a crafted convolution filter parameter, causing a denial of service.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-400 (Uncontrolled Resource Consumption)
  • Attack Vector: Network (AV:N)
  • Attack Complexity: Low (AC:L)
  • Privileges Required: None (PR:N)
  • User Interaction: None (UI:N)
  • CVSS v3.1 Score: 7.5 (High)
  • Exploit Status: Proof-of-Concept
  • KEV Status: Not Listed

Affected Systems

  • Thumbor image processing service running versions prior to 7.8.0
  • Thumbor: < 7.8.0 (Fixed in: 7.8.0)

Code Analysis

Commit: 3f38fe1

fix: prevent ReDoS in convolution filter regex. The matrix pattern (A;)A with [\d]+.?[\d] per element caused exponential backtracking on malformed input (2^N paths for N elements). Replace with -?\d+(?:.\d+)?(?:;-?\d+(?:.\d+)?)*, which is unambiguous and matches each token in exactly one way. Adds a regression test that replays the PoC payload under a 1-second timeout to prevent future regressions.

Exploit Details

Mitigation Strategies

  • Upgrade Thumbor to version 7.8.0 or higher.
  • Disable the convolution filter in the thumbor.conf file if it is not required by your application.
  • Configure WAF rules to drop HTTP requests containing abnormally long parameter lists within image filter vectors.

Remediation Steps:

  1. Identify all running instances of Thumbor in the application environment.
  2. Update the Thumbor dependency to version 7.8.0 or newer in the project's requirements.txt or setup.py file.
  3. Rebuild and deploy the application container or environment.
  4. Verify the fix by re-running non-destructive baseline ReDoS request tests and monitoring CPU usage.

References

Read the full report for CVE-2026-53504 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)