PYSEC-2026-3616
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/thumbor/PYSEC-2026-3616.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-3616
- Aliases
- Published
- 2026-08-04T11:34:46Z
- Modified
- 2026-08-04T14:30:17Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter
- Details
-
Summary
The regular expression used to parse the
convolutionfilter exhibits exponential-time backtracking for certain inputs, enabling a Regular Expression Denial of Service (ReDoS).Details
The RegExp for
convolutionis defined asconvolution\((?:\s*((?:[-]?[\d]+\.?[\d]*[;])*(?:[-]?[\d]+\.?[\d]*))\s*)(?:,\s*([\d]+)\s*)(?:,\s*([Tt]rue|[Ff]alse|1|0)\s*)?\). Within this expression a dangerous subpattern effectively behaves like(\d+)*,\d+.PoC
A filter string containing many repeated values will exhaust
re.match:convolution(-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11)- http://localhost:8888/unsafe/0x0/smart/filters:convolution(-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11)/x.png
The evaluation occurs on https://github.com/thumbor/thumbor/blob/master/thumbor/filters/__init__.py#L189.
Impact
A specially crafted URL will lead to denial of service, as new images won't be processed until
re.matchreturns. - References
-
- https://github.com/thumbor/thumbor/security/advisories/GHSA-5vjc-7cxw-4w6j
- https://github.com/thumbor/thumbor/commit/3f38fe1610d20168e91f76d432212de30727eb2e
- https://github.com/thumbor/thumbor
- https://github.com/thumbor/thumbor/releases/tag/7.8.0
- https://pypi.org/project/thumbor
- https://github.com/advisories/GHSA-5vjc-7cxw-4w6j
- https://nvd.nist.gov/vuln/detail/CVE-2026-53504
Affected packages
PyPI / thumbor
Package
- Name
- thumbor
- View open source insights on deps.dev
- Purl
- pkg:pypi/thumbor
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed7.8.0
Affected versions
4.*
4.1.3
4.4.1
4.5.3
4.5.4
4.6.0
4.7.0
4.7.1
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.9.0
4.9.1
4.10.0
4.10.1
4.10.2
4.10.3
4.11.0
4.11.1
4.12.0
4.12.1
4.12.2
5.*
5.0.0rc1
5.0.0rc2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.2.0
5.2.1
6.*
6.0.0b1
6.0.0b2
6.0.0b3
6.0.0b4
6.0.0b5
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.1.2
6.1.3
6.1.4
6.1.5
6.2.0
6.2.1
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.4.3
6.5.0
6.5.1
6.5.2
6.6.0
6.6.1
6.7.0
6.7.1
6.7.2
6.7.3
6.7.4
6.7.5
6.7.6
7.*
7.0.0a1
7.0.0a2
7.0.0a3
7.0.0a4
7.0.0a5
7.0.0b1
7.0.0
7.0.1
7.0.2
7.0.3
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
7.0.10
7.0.11
7.0.12
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.3.1
7.3.2
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.4.5
7.4.6
7.4.7
7.5.0
7.5.1
7.5.2
7.6.0
7.7.0
7.7.1
7.7.2
7.7.3
7.7.4
7.7.5
7.7.6
7.7.7