Executive brief
Thumbor is an open-source service used to resize and process images on the fly. A flaw in how it handles certain image filters allows an attacker to send a specially crafted web request that freezes the service. This can lead to a total service outage, preventing legitimate users from viewing or processing images.
Technical details
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the convolution filter of Thumbor. The root cause is an inefficient regular expression used to parse filter parameters, specifically a subpattern that behaves like (\d+)*,\d+, which triggers exponential backtracking when processing long strings of repeated numeric input. An unauthenticated remote attacker can exploit this by sending a crafted URL containing a malformed convolution filter string. This causes the Python interpreter to exhaust CPU resources while attempting to match the expression, leading to a denial of service for the image processing worker. The issue is resolved in version 7.8.0 by replacing the ambiguous regex with a non-backtracking alternative.
Affected products
- thumbor thumbor < 7.8.0
Timeline
- 2026-05-30: patched: Version 7.8.0 released
- 2026-06-10: advisory: GitHub Security Advisory published
- 2026-07-31: disclosed: CVE published to NVD