CVE-2026-53504 Details

A denial-of-service vulnerability has been identified in Thumbor, an open-source photo thumbnail service, in versions prior to 7.8.0. The issue arises in the convolution filter, where the regular expression used for parsing can be exploited through crafted numeric input. This exploitation causes exponential backtracking, leading to significant processing delays. The vulnerability allows a URL request to consume excessive processing time, effectively causing a denial-of-service condition by halting image processing until the regex evaluation completes.

Users are advised to upgrade to Thumbor version 7.8.0 or later, where this vulnerability has been fixed.