Thumbor, an open-source image thumbnail engine, contains a regular‑expression flaw in the convolution filter that causes exponential backtracking when processing specially crafted URLs with repeated numeric bytes. The effect is a denial of service, where a single request can exhaust processing time and resources, impacting availability of the service. This weakness corresponds to CWE‑400: Uncontrolled Resource Consumption.

Versions of Thumbor prior to 7.8.0, including 7.7.x and earlier, are affected. Users of any Thumbor deployment running the vulnerable filter should consider the version in the deployed environment.

The CVSS score of 7.5 indicates a moderate‑to‑high severity, and the EPSS score of less than 1 % suggests that active exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the ReDoS by issuing a crafted URL that includes a long numeric sequence to the convolution filter, forcing the server to perform extensive backtracking. Based on the description, the attack vector is inferred to be network‑based. Because the flaw resides in a public‑facing regular expression, the attack vector is network‑based and requires no local privileges.