PT-2026-66841 · Thumbor · Thumbor

CVE-2026-53504 · Published 2026-07-31 · Updated 2026-07-31

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Thumbor versions prior to 7.8.0

Description The convolution filter regular expression performs exponential backtracking when processing crafted repeated numeric input. This leads to a Regular Expression Denial of Service (ReDoS), where a specially crafted URL request can exhaust processing time, preventing new images from being processed until the operation completes. The issue occurs during the evaluation of the convolution filter in the thumbor/filters/ init .py file.

Recommendations Update to version 7.8.0.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-53504

GHSA-5VJC-7CXW-4W6J

Affected Products

Thumbor

References · 6

• 🔥 https://github.com/thumbor/thumbor/security/advisories/GHSA-5vjc-7cxw-4w6j · Exploit
• https://osv.dev/vulnerability/GHSA-5vjc-7cxw-4w6j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53504 · Security Note
• https://github.com/thumbor/thumbor/commit/3f38fe1610d20168e91f76d432212de30727eb2e · Note
• https://github.com/thumbor/thumbor/releases/tag/7.8.0 · Note
• https://github.com/thumbor/thumbor · Note