CVE-2026-53504: 
Python vulnerability analysis and mitigation

CVE-2026-53504 is a Regular Expression Denial of Service (ReDoS) vulnerability in Thumbor's convolution filter, an open-source photo thumbnail service by globo.com. The flaw affects all Thumbor versions up to and including 7.7.7 and was fixed in version 7.8.0. The vulnerability was originally reported by researcher geraldino2 and published to the GitHub Advisory Database on July 31, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory).

The root cause is uncontrolled resource consumption (CWE-400) caused by a vulnerable regular expression in thumbor/filters/convolution.py. The original regex pattern (?:[-]?[\d]+\.?[\d]*[;])*(?:[-]?[\d]+\.?[\d]*) contains an ambiguous subpattern that effectively behaves like (\d+)*,\d+, producing exponential backtracking (2^N paths for N elements) when evaluated against crafted malformed input. An unauthenticated remote attacker can trigger this by sending a specially crafted URL containing a convolution filter string with many repeated semicolon-separated numeric values, causing re.match in thumbor/filters/__init__.py (line 189) to consume excessive CPU time. The fix replaces the pattern with the unambiguous -?\d+(?:\.\d*)?(?:;-?\d+(?:\.\d*)?)*, which matches each token in exactly one way (Github Advisory, Patch Commit).

Successful exploitation causes a denial of service by blocking Thumbor's image processing pipeline for the duration of the regex evaluation — no new images can be processed until re.match returns. Because the attack requires no authentication, no privileges, and no user interaction, any internet-exposed Thumbor instance is at risk. There is no confidentiality or integrity impact; the sole consequence is high availability impact to the affected service (Github Advisory).

1. Reconnaissance: Identify internet-facing Thumbor instances (versions ≤ 7.7.7) using tools like Shodan or Censys, searching for the Thumbor HTTP service signature.
2. Craft malicious URL: Construct a URL targeting the Thumbor image endpoint with a convolution filter containing many repeated semicolon-separated numeric values, e.g.:

   http://<target>:8888/unsafe/0x0/smart/filters:convolution(-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11)/x.png

3. Send the request: Issue the HTTP GET request to the target. The malformed filter string triggers exponential backtracking in the convolution regex, consuming all available CPU time in the Thumbor worker process.
4. Achieve denial of service: The Thumbor service becomes unresponsive to new image processing requests for the duration of the regex evaluation. Repeating the request sustains the denial of service condition (Github Advisory).

• Network: Repeated HTTP GET requests to Thumbor endpoints containing filters:convolution( with long semicolon-separated numeric sequences (e.g., 20+ repeated values) in the URL path.
• Logs: Thumbor access logs showing requests with convolution filter strings containing many repeated numeric tokens followed by no trailing column count; unusually long request processing times or timeouts logged for image requests.
• Process: Thumbor worker processes showing sustained high CPU utilization (near 100%) without completing image processing tasks; worker processes becoming unresponsive or timing out.

The primary remediation is to upgrade Thumbor to version 7.8.0 or later, which replaces the vulnerable regex with an unambiguous pattern that eliminates exponential backtracking (Thumbor Release, Patch Commit). As a temporary workaround for deployments that cannot immediately upgrade, operators should consider placing a web application firewall or reverse proxy in front of Thumbor to block or rate-limit requests containing convolution filter strings with excessive repeated numeric values. Restricting public access to the Thumbor service (e.g., requiring authentication at the proxy layer) also reduces exposure.