high7.5
CVE-2026-53504
Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter
Impact
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on crafted repeated numeric input, allowing a URL request to exhaust processing time. This issue is fixed in 7.8.0.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | thumbor | <= 7.7.7 | 7.8.0 |