https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Mon, 03 Aug 2026 20:40:41 +0000 https://vulnerability.circl.lu/sighting/af0097e8-8eb6-4e3c-a173-b57a68050c3d/export {"uuid": "af0097e8-8eb6-4e3c-a173-b57a68050c3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-53504", "type": "published-proof-of-concept", "source": "https://github.com/thumbor/thumbor/security/advisories/GHSA-5vjc-7cxw-4w6j", "content": "", "creation_timestamp": "2026-07-31T20:35:27.032375Z"} {"uuid": "af0097e8-8eb6-4e3c-a173-b57a68050c3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-53504", "type": "published-proof-of-concept", "source": "https://github.com/thumbor/thumbor/security/advisories/GHSA-5vjc-7cxw-4w6j", "content": "", "creation_timestamp": "2026-07-31T20:35:27.032375Z"} https://vulnerability.circl.lu/sighting/af0097e8-8eb6-4e3c-a173-b57a68050c3d/export Fri, 31 Jul 2026 20:35:27 +0000 https://vulnerability.circl.lu/sighting/e857bbe0-81db-4589-a7b8-ef373b73acfe/export {"uuid": "e857bbe0-81db-4589-a7b8-ef373b73acfe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53504", "type": "seen", "source": "https://gist.github.com/alon710/de1c5b8263f3d3a5d1101a3c2a0269ab", "content": "# CVE-2026-53504: CVE-2026-53504: Regular Expression Denial of Service (ReDoS) in Thumbor Convolution Filter\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-31\n> **Full Report:** https://cvereports.com/reports/CVE-2026-53504\n\n## Summary\nA critical Regular Expression Denial of Service (ReDoS) vulnerability exists in Thumbor prior to version 7.8.0. The vulnerability resides within the dynamic filter-parsing engine, specifically inside the 'convolution' filter parameter processing logic. Due to overlapping and nested quantifiers in the regular expression used to parse matrix values, a remote, unauthenticated attacker can supply a specially crafted, malformed filter payload inside a request URL. This causes Python's standard NFA-based regular expression engine to undergo exponential backtracking, exhausting CPU resources and leading to a complete Denial of Service.\n\n## TL;DR\nUnauthenticated remote attackers can trigger exponential CPU backtracking in Thumbor (< 7.8.0) via a crafted convolution filter parameter, causing a denial of service.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400 (Uncontrolled Resource Consumption)\n- **Attack Vector**: Network (AV:N)\n- **Attack Complexity**: Low (AC:L)\n- **Privileges Required**: None (PR:N)\n- **User Interaction**: None (UI:N)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Thumbor image processing service running versions prior to 7.8.0\n- **Thumbor**: < 7.8.0 (Fixed in: `7.8.0`)\n\n## Mitigation\n\n- Upgrade Thumbor to version 7.8.0 or higher.\n- Disable the convolution filter in the thumbor.conf file if it is not required by your application.\n- Configure WAF rules to drop HTTP requests containing abnormally long parameter lists within image filter vectors.\n\n**Remediation Steps:**\n1. Identify all running instances of Thumbor in the application environment.\n2. Update the Thumbor dependency to version 7.8.0 or newer in the project's requirements.txt or setup.py file.\n3. Rebuild and deploy the application container or environment.\n4. Verify the fix by re-running non-destructive baseline ReDoS request tests and monitoring CPU usage.\n\n## References\n\n- [GitHub Security Advisory GHSA-5vjc-7cxw-4w6j](https://github.com/thumbor/thumbor/security/advisories/GHSA-5vjc-7cxw-4w6j)\n- [Fix Commit 3f38fe1](https://github.com/thumbor/thumbor/commit/3f38fe1610d20168e91f76d432212de30727eb2e)\n- [CVE-2026-53504 Record on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-53504)\n- [Thumbor Release 7.8.0](https://github.com/thumbor/thumbor/releases/tag/7.8.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-53504) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T19:31:28.872484Z"} {"uuid": "e857bbe0-81db-4589-a7b8-ef373b73acfe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53504", "type": "seen", "source": "https://gist.github.com/alon710/de1c5b8263f3d3a5d1101a3c2a0269ab", "content": "# CVE-2026-53504: CVE-2026-53504: Regular Expression Denial of Service (ReDoS) in Thumbor Convolution Filter\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-31\n> **Full Report:** https://cvereports.com/reports/CVE-2026-53504\n\n## Summary\nA critical Regular Expression Denial of Service (ReDoS) vulnerability exists in Thumbor prior to version 7.8.0. The vulnerability resides within the dynamic filter-parsing engine, specifically inside the 'convolution' filter parameter processing logic. Due to overlapping and nested quantifiers in the regular expression used to parse matrix values, a remote, unauthenticated attacker can supply a specially crafted, malformed filter payload inside a request URL. This causes Python's standard NFA-based regular expression engine to undergo exponential backtracking, exhausting CPU resources and leading to a complete Denial of Service.\n\n## TL;DR\nUnauthenticated remote attackers can trigger exponential CPU backtracking in Thumbor (< 7.8.0) via a crafted convolution filter parameter, causing a denial of service.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400 (Uncontrolled Resource Consumption)\n- **Attack Vector**: Network (AV:N)\n- **Attack Complexity**: Low (AC:L)\n- **Privileges Required**: None (PR:N)\n- **User Interaction**: None (UI:N)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Thumbor image processing service running versions prior to 7.8.0\n- **Thumbor**: < 7.8.0 (Fixed in: `7.8.0`)\n\n## Mitigation\n\n- Upgrade Thumbor to version 7.8.0 or higher.\n- Disable the convolution filter in the thumbor.conf file if it is not required by your application.\n- Configure WAF rules to drop HTTP requests containing abnormally long parameter lists within image filter vectors.\n\n**Remediation Steps:**\n1. Identify all running instances of Thumbor in the application environment.\n2. Update the Thumbor dependency to version 7.8.0 or newer in the project's requirements.txt or setup.py file.\n3. Rebuild and deploy the application container or environment.\n4. Verify the fix by re-running non-destructive baseline ReDoS request tests and monitoring CPU usage.\n\n## References\n\n- [GitHub Security Advisory GHSA-5vjc-7cxw-4w6j](https://github.com/thumbor/thumbor/security/advisories/GHSA-5vjc-7cxw-4w6j)\n- [Fix Commit 3f38fe1](https://github.com/thumbor/thumbor/commit/3f38fe1610d20168e91f76d432212de30727eb2e)\n- [CVE-2026-53504 Record on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-53504)\n- [Thumbor Release 7.8.0](https://github.com/thumbor/thumbor/releases/tag/7.8.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-53504) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T19:31:28.872484Z"} https://vulnerability.circl.lu/sighting/e857bbe0-81db-4589-a7b8-ef373b73acfe/export Fri, 31 Jul 2026 19:31:28 +0000