GHSA-5vjc-7cxw-4w6j

Suggest an improvement
Source
https://github.com/advisories/GHSA-5vjc-7cxw-4w6j
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-5vjc-7cxw-4w6j/GHSA-5vjc-7cxw-4w6j.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-5vjc-7cxw-4w6j
Aliases
Published
2026-07-31T18:58:28Z
Modified
2026-08-04T14:40:45Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter
Details

Summary

The regular expression used to parse the convolution filter exhibits exponential-time backtracking for certain inputs, enabling a Regular Expression Denial of Service (ReDoS).

Details

The RegExp for convolution is defined as convolution\((?:\s*((?:[-]?[\d]+\.?[\d]*[;])*(?:[-]?[\d]+\.?[\d]*))\s*)(?:,\s*([\d]+)\s*)(?:,\s*([Tt]rue|[Ff]alse|1|0)\s*)?\). Within this expression a dangerous subpattern effectively behaves like (\d+)*,\d+.

PoC

A filter string containing many repeated values will exhaust re.match:

  • convolution(-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11)
  • http://localhost:8888/unsafe/0x0/smart/filters:convolution(-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11)/x.png

The evaluation occurs on https://github.com/thumbor/thumbor/blob/master/thumbor/filters/__init__.py#L189.

Impact

A specially crafted URL will lead to denial of service, as new images won't be processed until re.match returns.

Database specific 
{
    "cwe_ids":  [
        "CWE-400"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-31T18:58:28Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}
References

Affected packages

PyPI / thumbor

Package

Name
thumbor
View open source insights on deps.dev
Purl
pkg:pypi/thumbor

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
7.8.0

Affected versions

4.*
4.1.3
4.4.1
4.5.3
4.5.4
4.6.0
4.7.0
4.7.1
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.9.0
4.9.1
4.10.0
4.10.1
4.10.2
4.10.3
4.11.0
4.11.1
4.12.0
4.12.1
4.12.2
5.*
5.0.0rc1
5.0.0rc2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.2.0
5.2.1
6.*
6.0.0b1
6.0.0b2
6.0.0b3
6.0.0b4
6.0.0b5
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.1.2
6.1.3
6.1.4
6.1.5
6.2.0
6.2.1
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.4.3
6.5.0
6.5.1
6.5.2
6.6.0
6.6.1
6.7.0
6.7.1
6.7.2
6.7.3
6.7.4
6.7.5
6.7.6
7.*
7.0.0a1
7.0.0a2
7.0.0a3
7.0.0a4
7.0.0a5
7.0.0b1
7.0.0
7.0.1
7.0.2
7.0.3
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
7.0.10
7.0.11
7.0.12
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.3.1
7.3.2
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.4.5
7.4.6
7.4.7
7.5.0
7.5.1
7.5.2
7.6.0
7.7.0
7.7.1
7.7.2
7.7.3
7.7.4
7.7.5
7.7.6
7.7.7

Database specific

last_known_affected_version_range 
"<= 7.7.7"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-5vjc-7cxw-4w6j/GHSA-5vjc-7cxw-4w6j.json"