What is the CVSS score of CVE-2026-53504?

CVE-2026-53504 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Thumbor are affected by CVE-2026-53504?

Thumbor versions 7.7.7 and earlier can be remotely disabled by unauthenticated attackers, disrupting image delivery for web applications and services.. A patch is available.

Is there a public PoC exploit available for CVE-2026-53504?

Yes, a public proof-of-concept exploit is available for CVE-2026-53504. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-53504?

Within 24 hours, inventory all Thumbor deployments and confirm whether any are exposed to the internet or untrusted networks; isolate or apply temporary network restrictions if full assessment cannot be completed immediately. Within 7 days, deploy the patched Thumbor version available from the vendor advisory to all affected instances, prioritizing production and customer-facing systems. Within 30 days, verify successful patching across all systems, review access logs for exploitation attempts during the gap period, and confirm image processing services are functioning normally post-patch.

Thumbor CVE-2026-53504

EUVD-2026-51610 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-31 https://github.com/thumbor/thumbor

GHSA-5vjc-7cxw-4w6j

Denial Of Service

7.5

CVSS 3.1 · Vendor: https://github.com/thumbor/thumbor

Severity by source

Vendor (https://github.com/thumbor/thumbor) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-accessible filter parsing requires no auth or interaction; only availability is impacted via CPU exhaustion from regex backtracking.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/thumbor/thumbor).

CVSS VectorVendor: https://github.com/thumbor/thumbor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 31, 2026 - 19:21 vuln.today

Analysis Generated

Jul 31, 2026 - 19:21 vuln.today

CVE Published

Jul 31, 2026 - 18:58 github-advisory

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

24 pypi packages depend on thumbor (24 direct, 0 indirect)

Ecosystem-wide dependent count for version 7.8.0.

DescriptionCVE.org

Summary

The regular expression used to parse the convolution filter exhibits exponential-time backtracking for certain inputs, enabling a Regular Expression Denial of Service (ReDoS).

Details

The RegExp for convolution is defined as convolution\((?:\s*((?:[-]?[\d]+\.?[\d]*[;])*(?:[-]?[\d]+\.?[\d]*))\s*)(?:,\s*([\d]+)\s*)(?:,\s*([Tt]rue|[Ff]alse|1|0)\s*)?\). Within this expression a dangerous subpattern effectively behaves like (\d+)*,\d+.

PoC

A filter string containing many repeated values will exhaust re.match:

convolution(-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11)
http://localhost:8888/unsafe/0x0/smart/filters:convolution(-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11)/x.png

The evaluation occurs on https://github.com/thumbor/thumbor/blob/master/thumbor/filters/__init__.py#L189.

Impact

A specially crafted URL will lead to denial of service, as new images won't be processed until re.match returns.

AnalysisAI

Denial of service in Thumbor's convolution image filter allows unauthenticated remote attackers to exhaust server processing capacity by submitting a crafted URL. Versions 7.7.7 and earlier contain a regular expression in the convolution filter parser whose subpattern (A;)*A causes Python's re module to exhibit exponential-time backtracking when the input is malformed (e.g., missing the required trailing column count). A public proof-of-concept is included in the GitHub Security Advisory, and no special configuration is required to trigger the flaw against a default Thumbor deployment. No CISA KEV listing exists at time of analysis, but the trivial exploitation path and public PoC make this a real priority for network-exposed instances.

Technical ContextAI

Thumbor (pip/thumbor) is a Python smart imaging service that processes on-the-fly image transformations via URL-encoded filter strings. The convolution filter in thumbor/filters/convolution.py registers a BaseFilter regex to parse matrix parameters. The vulnerable pattern contains the subpattern ((?:[-]?[\d]+\.?[\d]*[;])*(?:[-]?[\d]+\.?[\d]*)), which structurally reduces to (A;)*A - a classic ambiguous repetition that causes catastrophic backtracking in Python's non-possessive re module when the engine must explore all possible ways to partition a long digit-semicolon sequence before determining a mismatch. This is a textbook CWE-400 (Uncontrolled Resource Consumption) instance: the evaluation site is thumbor/filters/__init__.py line 189. The fix, applied in commit 3f38fe16, replaces the pattern with the unambiguous possessive-equivalent -?\d+(?:\.\d*)?(?:;-?\d+(?:\.\d*)?)*, which eliminates the backtracking ambiguity.

RemediationAI

Upgrade to Thumbor 7.8.0 or later, available at https://github.com/thumbor/thumbor/releases/tag/7.8.0 (patch commit 3f38fe1610d20168e91f76d432212de30727eb2e). The fix rewrites the convolution filter regex to eliminate the ambiguous repetition group, resolving the backtracking without altering valid filter behavior. If immediate upgrade is not feasible, restrict HTTP access to the Thumbor service endpoint at the reverse proxy or firewall layer to trusted internal clients only - this eliminates the network-accessible attack vector but requires infrastructure changes and may not be practical for public imaging services. Alternatively, disable the convolution filter by removing or restricting it in the Thumbor filter pipeline configuration; note that this prevents all legitimate convolution-based image transformations. URL signing (disabling the /unsafe/ path) reduces but does not eliminate risk: a signed URL containing the malicious convolution filter string would still trigger backtracking. Do not rely on upstream timeout mechanisms as a primary control, as a per-worker block will still degrade throughput before any timeout fires.