Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on c…

CVE-2026-53504 affects Thumbor, an open-source photo thumbnail service developed by globo.com. The vulnerability exists in the convolution filter's regular expression, which is susceptible to exponential backtracking when processing crafted repeated numeric input. An attacker can exploit this by sending a specially crafted URL request that causes the service to exhaust processing time, resulting in a denial of service condition. This is classified as a ReDoS (Regular Expression Denial of Service) vulnerability. The issue affects all versions of Thumbor prior to 7.8.0. The fix was introduced in version 7.8.0, which patches the problematic regular expression. Users are strongly advised to upgrade to version 7.8.0 or later to mitigate this risk.