Listen to this Post
How CVE-2026-53504 Works
Thumbor is an open-source photo thumbnail service widely used to crop, resize, and filter images on the fly. Prior to version 7.8.0, its `convolution` filter—which applies custom matrix-based image kernels—contained a dangerous regular expression vulnerability.
The vulnerable regex responsible for parsing the `convolution` filter parameters is defined as:
`convolution\((?:\s((?:[-]?[\d]+\.?[\d][;])(?:[-]?[\d]+\.?[\d]))\s)(?:,\s([\d]+)\s)(?:,\s(
rue|[bash]alse|1|0)\s)?\)`</h2>
Within this expression, a subpattern effectively behaves like <code>(\d+),\d+</code>. This construction is a classic ReDoS trigger because it contains nested quantifiers (the outer `` and the inner <code>+</code>) that operate on overlapping character sets. When the regex engine attempts to match a long string of repeated numeric values separated by semicolons—but deliberately missing the trailing `,<columns>` parameter—the engine enters a state of catastrophic backtracking.
The PoC payload provided in the security advisory is a filter string with 30 repeated `-11` values:
<h2 style="color: blue;">`convolution(-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11)`.</h2>
For an input with `N` elements, the exponential backtracking explores `2^N` possible matching paths, rapidly consuming 100% CPU and blocking the Thumbor event loop. Since the regex evaluation occurs synchronously in <code>thumbor/filters/__init__.pyL189</code>, the entire image processing pipeline becomes unresponsive until the match either completes or times out—which for sufficiently long inputs may never happen.
The vulnerability is assigned CVE-2026-53504 with a CVSS 3.1 base score of 7.5 (High) , reflecting a network-accessible attack with low complexity and no privileges required. The attack vector is <code>AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</code>, meaning only availability is impacted.
<h2 style="color: blue;">DailyCVE Form</h2>
Platform: Thumbor
Version: < 7.8.0
Vulnerability: ReDoS (Regex DoS)
Severity: High (CVSS 7.5)
date: 2026-07-31
<h2 style="color: blue;">Prediction: 2026-08-07 (7 days)</h2>
<h2 style="color: blue;">What Undercode Say: Analytics</h2>
The vulnerable regex lives in <code>thumbor/filters/__init__.py</code>. The following command can be used to test whether a Thumbor instance is vulnerable by sending a crafted URL:
[bash]
curl "http://target-thumbor:8888/unsafe/convolution(-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11)/filters:convolution(...)/path/to/image.jpg"
The fix commit `3f38fe1` replaces the dangerous pattern with an unambiguous one:
`-?\d+(?:\.\d+)?(?:;-?\d+(?:\.\d+)?)`
This new regex matches each token in exactly one way, eliminating backtracking paths.
A regression test was added to prevent future regressions, using a 1-second `SIGALRM` timeout to ensure the PoC payload completes within acceptable bounds:
def test_convolution_redos_does_not_hang(self):
Filter.pre_compile()
malicious = "convolution(" + ";".join(["-11"] 30) + ")"
def _timeout_handler(signum, frame):
raise AssertionError("ReDoS: convolution regex did not complete within 1 second")
signal.signal(signal.SIGALRM, _timeout_handler)
signal.alarm(1)
try:
result = Filter.regex.match(malicious)
finally:
signal.alarm(0)
Exploit
An attacker can exploit this vulnerability by crafting a URL with a `convolution` filter containing a long sequence of repeated numeric values separated by semicolons, while omitting the required trailing `,
Because the Thumbor service processes image URLs synchronously, a single malicious request will consume all available CPU resources on the regex evaluation, causing the service to stall. Subsequent legitimate image requests will queue up or timeout, resulting in a complete denial of service. The attack requires no authentication, no user interaction, and can be launched remotely over the network.
Protection
The primary and recommended mitigation is to upgrade Thumbor to version 7.8.0 or later, where the regex has been patched.
For environments where immediate upgrade is not possible, the following temporary measures can be applied:
– Deploy a Web Application Firewall (WAF) to detect and block URL patterns containing excessively long `convolution` filter parameters with repeated semicolon-separated values.
– Implement rate limiting on image processing requests to reduce the impact of any single attacker.
– Monitor CPU usage and request processing times for anomalies that may indicate an ongoing ReDoS attack.
– Apply input length limits on the `convolution` filter string before it reaches the regex engine.
Impact
Successful exploitation leads to denial of service affecting the availability of the Thumbor service. The impact is severe because:
– A single crafted request can render the entire image processing pipeline unresponsive.
– There is no impact on confidentiality or integrity—only availability is compromised.
– The attack vector is trivial to execute, requiring no special privileges or user interaction.
– In production environments serving high traffic, even a brief outage can degrade user experience and disrupt business operations.
The vulnerability affects all Thumbor deployments prior to version 7.8.0. Given the widespread use of Thumbor in media-heavy applications, unpatched instances remain at risk until upgraded.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
