StatewardStateward
← All vulnerabilities
HIGHSupply chain

CVE-2026-53504

PyPI · thumbor

Summary

Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter

Advisory details

Summary

The regular expression used to parse the convolution filter exhibits exponential-time backtracking for certain inputs, enabling a Regular Expression Denial of Service (ReDoS).

Details

The RegExp for convolution is defined as convolution\((?:\s*((?:[-]?[\d]+\.?[\d]*[;])*(?:[-]?[\d]+\.?[\d]*))\s*)(?:,\s*([\d]+)\s*)(?:,\s*([Tt]rue|[Ff]alse|1|0)\s*)?\). Within this expression a dangerous subpattern effectively behaves like (\d+)*,\d+.

PoC

A filter string containing many repeated values will exhaust re.match:

The evaluation occurs on https://github.com/thumbor/thumbor/blob/master/thumbor/filters/__init__.py#L189.

Impact

A specially crafted URL will lead to denial of service, as new images won't be processed until re.match returns.

References

Related vulnerabilities

All Supply chain →