CVE-2026-53504: Regular Expression Denial of Service (ReDoS) in Thumbor Convolution Filter

Thumbor is an open-source smart imaging service that processes, resizes, and filters images on demand. It features a wide array of filters, such as convolution, which allows users to define custom spatial filters using matrix-based operations. The application is designed to be highly accessible and performance-focused, often integrated into high-traffic web environments to serve dynamic assets.

To handle requests efficiently, Thumbor relies on the Tornado web framework. Tornado uses an asynchronous, single-threaded event loop architecture to handle multiple concurrent network connections. While this model is highly efficient for I/O-bound tasks, it is susceptible to starvation when processing CPU-bound tasks.

The filter-parsing mechanism represents a substantial attack surface. When parsing filter options directly from the URL path, Thumbor uses regular expressions to validate and extract parameter sets. In the case of the convolution filter, a flaw in the regular expression design allows unauthenticated users to trigger exponential execution times, completely blocking the single-threaded worker process.

The root cause of this vulnerability lies in the design of the regular expression utilized by the convolution filter parser. Specifically, the parser attempts to validate a list of semicolon-separated matrix coefficients. The vulnerable pattern is defined as (?:[-]?[\d]+\.?[\d]*[;])*(?:[-]?[\d]+\.?[\d]*). This structure contains nested and overlapping quantifiers.

Python's native re module uses a Non-deterministic Finite Automaton (NFA) engine. When matching a target string, an NFA engine processes inputs by exploring potential paths. If a path fails to match, the engine backtracks to try alternative configurations. Overlapping quantifiers within the subpatterns allow a single string to be interpreted in multiple ways, causing the engine to evaluate a massive state space before returning a mismatch.

The subpattern [-]?[\d]+\.?[\d]* contains ambiguity because a string of digits (e.g., 11) can be matched by [\d]+ entirely, or divided between [\d]+ and [\d]*. Furthermore, nesting this pattern inside a repeating group followed by a trailing duplicate pattern creates an exponential search complexity. On malformed input that fails at the final step, the engine attempts $2^N$ backtracking combinations for $N$ parameters, driving CPU utilization to 100%.

To analyze the flaw, we can inspect the core filter file thumbor/filters/convolution.py. Before the security patch, the filter registration decorator defined the following evaluation regex:

# Vulnerable regex definition in thumbor/filters/convolution.py
@filter_method(
    r"(?:[-]?[\d]+\.?[\d]*[;])*(?:[-]?[\d]+\.?[\d]*)",
    BaseFilter.PositiveNonZeroNumber,
    BaseFilter.Boolean,
)

In this implementation, the Kleene star on the non-capturing group (?:...)* matches any number of semicolon-terminated matrix items, while the subsequent pattern handles the final matrix element. Because both patterns utilize the ambiguous float-matching regex, the boundary between items becomes indistinct during failures.

The security patch refactored the regular expression to ensure a strict, linear matching behavior. The updated decorator is defined as:

# Patched regex definition in thumbor/filters/convolution.py
@filter_method(
    r"-?[\d]+(?:\.[\d]*)?(?:;-?[\d]+(?:\.[\d]*)?)*",
    BaseFilter.PositiveNonZeroNumber,
    BaseFilter.Boolean,
)

The new regex eliminates the overlapping parsing states. By explicitly separating integers and decimal points ((?:\.[\d]*)?) and changing the loop structure from (A;)*A to A(?:;A)*, the parser matches matrix elements deterministically. There is only one valid traversal path per character sequence, reducing execution complexity from $O(2^N)$ to $O(N)$.

Exploitation of CVE-2026-53504 is straightforward and requires only network access to the target instance. The attacker must submit a malformed request pointing to the convolution filter. Since the regular expression requires trailing parameters (like column count and normalization flag) to match successfully, omitting these parameters forces the parser to evaluate the entire sequence and fail.

A typical exploit payload consists of a standard Thumbor image request URL with an elongated list of negative integers:

GET /unsafe/filters:convolution(-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11)/path/to/image.jpg HTTP/1.1
Host: target-thumbor-instance.local

When the Tornado backend receives this request, it attempts to match the filter parameters against the registered regular expressions. The NFA engine begins to parse the 30 semicolon-separated values. Upon reaching the end of the convolution argument block, the engine detects that the required trailing values are missing, causing a mismatch. It then begins to backtrack through every permutation of the digit groupings. This process requires over one billion state evaluations, keeping the Tornado worker thread at 100% CPU capacity for several minutes.

The impact of this vulnerability is a complete Denial of Service (DoS) affecting the image rendering pipeline. Because Thumbor processes are typically bound to a single thread using the Tornado event loop, a single malformed HTTP request can completely block the thread. This halts the processing of all other concurrent requests handled by that specific worker process.

In environments where multiple workers are deployed, an attacker can scale the attack by sending a small burst of requests (one per worker process). This easily exhausts the entire backend pool. Since CPU resources are fully consumed by the backtracking loop, the underlying server instances also experience severe performance degradation, potentially impacting other services hosted on the same infrastructure.

This vulnerability does not allow for remote code execution, privilege escalation, or direct data leakage. However, its high reliability and low complexity make it an effective tool for disruption. It receives a CVSS v3.1 score of 7.5, indicating High severity due to its critical impact on service availability.

The primary remediation step is to upgrade the Thumbor installation to version 7.8.0 or later. This release updates the convolution filter regular expression, removing the nested quantifiers and ensuring linear matching times.

For environments where an immediate upgrade is not feasible, several defensive workarounds can be implemented. If the convolution filter is not required by the application, it can be disabled or removed from the active filter list within the Thumbor configuration file (thumbor.conf).

Alternatively, network-level web application firewalls (WAFs) can be configured to inspect incoming URLs. Rules should block requests containing abnormally long arguments within the filters:convolution block. Setting up strict rate limiting and ensuring that the event loop can timeout slow operations also helps mitigate the severity of resource exhaustion attacks.