CVE-2026-53504: Thumbor DOS Vulnerability via ReDoS

CVE-2026-53504 Overview

Thumbor is an open-source photo thumbnail service maintained by globo.com. Versions prior to 7.8.0 contain a regular expression denial-of-service (ReDoS) flaw in the convolution filter. The filter's regex performs exponential backtracking when supplied with crafted repeated numeric input, causing the process to consume CPU time on a single URL request. Attackers can send unauthenticated HTTP requests to exhaust processing time on the Thumbor worker. The issue is fixed in version 7.8.0. This weakness is classified under [CWE-400] Uncontrolled Resource Consumption.

Critical Impact
A single unauthenticated network request containing a crafted convolution filter parameter can stall a Thumbor worker, degrading or halting image processing service availability.

Affected Products

Thumbor versions prior to 7.8.0
Deployments exposing the convolution filter over HTTP
Downstream services and CDNs relying on Thumbor for image transformation

Discovery Timeline

2026-07-31 - CVE-2026-53504 published to NVD
2026-08-01 - Last updated in NVD database

Technical Details for CVE-2026-53504

Vulnerability Analysis

The convolution filter accepts a matrix argument through the URL. Thumbor parses the argument using a regular expression that validates semicolon-separated signed decimal values. The original pattern nests optional quantifiers around a repeated group, which triggers catastrophic backtracking on inputs that almost match but eventually fail. Processing a crafted argument forces the regex engine to explore an exponential number of paths before rejecting the input. The result is high CPU utilization and unresponsive workers, denying service to legitimate image requests.

Root Cause

The vulnerable pattern (?:[-]?[\d]+\.?[\d]*[;])*(?:[-]?[\d]+\.?[\d]*) contains overlapping quantifiers on \d+ and \d* inside a repeated non-capturing group. Numeric strings can be matched by multiple sub-expressions, so the engine backtracks through every combination when the trailing character breaks the match. This is a textbook ambiguous-alternation ReDoS pattern.

Attack Vector

An unauthenticated remote attacker crafts a Thumbor URL invoking the convolution filter with a long sequence of digits that does not terminate with a valid separator. The HTTP request reaches the filter parser, which runs the vulnerable regex and blocks the worker until it exhausts backtracking paths.

python

# Security patch in thumbor/filters/convolution.py
# Source: https://github.com/thumbor/thumbor/commit/3f38fe1610d20168e91f76d432212de30727eb2e
    """

    @filter_method(
-        r"(?:[-]?[\d]+\.?[\d]*[;])*(?:[-]?[\d]+\.?[\d]*)",
+        r"-?\d+(?:\.\d*)?(?:;-?\d+(?:\.\d*)?)*",
        BaseFilter.PositiveNonZeroNumber,
        BaseFilter.Boolean,
    )

The patched regex removes the ambiguous overlap by anchoring each numeric token to a single \d+ followed by an optional decimal group, then repeating the semicolon-prefixed token. Documentation was updated in docs/convolution.rst to require digits after the decimal point (for example 1.5).

Detection Methods for CVE-2026-53504

Indicators of Compromise

HTTP request URIs containing convolution( with long runs of digits or unusual repeated numeric patterns
Thumbor worker processes exhibiting sustained 100% CPU on a single request
Request handler timeouts, worker restarts, or upstream 504 responses tied to image URLs
Increased latency for image transformations without a corresponding traffic spike

Detection Strategies

Inspect access logs for convolution filter invocations with abnormally long matrix_items arguments
Alert on Thumbor request durations exceeding baseline percentiles for filter endpoints
Correlate CPU saturation on image-processing hosts with specific request IDs and source addresses
Deploy a web application firewall rule that flags convolution matrix arguments exceeding a reasonable length threshold

Monitoring Recommendations

Track per-request CPU time and enforce a hard timeout on filter processing
Emit metrics for regex evaluation duration in the filter pipeline
Monitor request rate to convolution versus other filters and alert on anomalies
Log the full filter argument string (with size caps) for post-incident analysis

How to Mitigate CVE-2026-53504

Immediate Actions Required

Upgrade Thumbor to version 7.8.0 or later
If upgrade is not immediate, restrict access to the convolution filter through URL signing or an upstream proxy
Enforce a per-request CPU or wall-clock timeout on Thumbor workers
Rate-limit unauthenticated clients invoking image transformation endpoints

Patch Information

The fix is delivered in Thumbor 7.8.0. Details are available in the GitHub Security Advisory GHSA-5vjc-7cxw-4w6j, the GitHub Release 7.8.0, and the GitHub Commit Update. Package the update through your normal dependency manager and redeploy all Thumbor workers.

Workarounds

Enable Thumbor URL signing (SECURITY_KEY) so only signed requests can invoke filters
Block or strip requests containing convolution at an upstream reverse proxy until the patch is applied
Cap the maximum URL length accepted by the front-end proxy to reduce the impact of long matrix arguments
Run Thumbor workers with strict CPU cgroup limits so a single stalled worker cannot starve the host

bash

# Example NGINX rule to block oversized convolution arguments upstream
location / {
    if ($args ~* "convolution\([^)]{200,}\)") {
        return 400;
    }
    proxy_pass http://thumbor_upstream;
    proxy_read_timeout 5s;
}