high · 7.5CVE-2026-53504Jul 31, 2026

CVE-2026-53504: thumbor ReDoS in convolution Filter

Rohit Hatagale
AI Security Researcher, SecureLayer7

A crafted image URL with many semicolon-separated convolution values causes thumbor's regex parser to spin indefinitely, blocking all image processing on the server.

Packagethumbor
Ecosystempip
Affected<= 7.7.7
Fixed in7.8.0
CVE-2026-53504: thumbor ReDoS in convolution Filter

The problem

The convolution filter in thumbor <= 7.7.7 uses a hand-written regex to parse its matrix_items argument. The regex contains nested quantifiers that create ambiguous match paths, so Python's backtracking re engine takes exponential time on malformed input that almost-but-never-fully matches.

Because filter parsing happens synchronously on every inbound request, a single crafted URL stalls the worker until re.match returns. No authentication is required. Any anonymous HTTP client can trigger it.

Proof of concept

A working proof-of-concept for CVE-2026-53504 in thumbor, with the exact payload below.

http
GET /unsafe/0x0/smart/filters:convolution(-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11)/x.png HTTP/1.1
Host: localhost:8888

The vulnerable regex for matrix_items is effectively ((?:[-]?[\d]+\.?[\d]*[;])*(?:[-]?[\d]+\.?[\d]*)) followed by a mandatory comma and more groups. This collapses to the classic catastrophic pattern (\d+)*,\d+: the engine can split the digit sequence across the outer repeat and the inner groups in an exponential number of ways before concluding there is no match.

The PoC payload ends without the required comma and number-of-columns argument, so the match always fails after exhausting all split combinations. Appending 30 repetitions of -11; is enough to make the backtracking visibly slow; more repetitions make it effectively hang.

The patch commit 3f38fe1 rewrites the filter's regex so the alternatives are unambiguous and possessive (or atomic), eliminating any possibility of exponential backtracking.

The fix

Upgrade thumbor to 7.8.0 or later (pip install --upgrade thumbor). The fix is in commit 3f38fe1610d20168e91f76d432212de30727eb2e, which replaces the catastrophic regex in thumbor/filters/__init__.py with one that cannot backtrack exponentially.

Reporter not attributed.

References: [1][2][3][4]

Related research