https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-01T11:26:27.848586+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-53504 CVE-2026-53504 — Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter 2026-10-01T11:26:27.867589+00:00

Affected: thumbor

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on crafted repeated numeric input, allowing a URL request to exhaust processing time. This issue is fixed in 7.8.0.

 https://db.gcve.eu/vuln/ghsa-5vjc-7cxw-4w6j GHSA-5vjc-7cxw-4w6j — Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter 2026-10-01T11:26:27.867682+00:00

Affected: PyPI: thumbor

### Summary The regular expression used to parse the `convolution` filter exhibits exponential-time backtracking for certain inputs, enabling a Regular Expression Denial of Service (ReDoS).

### Details The RegExp for `convolution` is defined as `convolution\((?:\s*((?:[-]?[\d]+\.?[\d]*[;])*(?:[-]?[\d]+\.?[\d]*))\s*)(?:,\s*([\d]+)\s*)(?:,\s*([Tt]rue|[Ff]alse|1|0)\s*)?\)`. Within this expression a dangerous subpattern effectively behaves like `(\d+)*,\d+`.

### PoC A filter string containing many repeated values will exhaust `re.match`: - `convolution(-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11)` - http://localhost:8888/unsafe/0x0/smart/filters:convolution(-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11)/x.png

The evaluation occurs on https://github.com/thumbor/thumbor/blob/master/thumbor/filters/__init__.py#L189.

### Impact A specially crafted URL will lead to denial of service, as new images won't be processed until `re.match` returns.