The vulnerability in Thumbor's `convolution` filter is due to a regular expression that parses filter parameters with a pattern that can trigger exponential-time backtracking. Specifically, the regex includes a subpattern behaving like `(\d+)*,\d+`, which is vulnerable to ReDoS attacks when given input with many repeated numeric values separated by semicolons. An attacker can craft a URL with a convolution filter containing many repeated values, causing the regex engine to consume excessive CPU time and effectively deny service by blocking image processing. This issue affects Thumbor versions before 7.8.0 and is tracked as CVE-2026-53504 with a CVSS 3.1 base score of 7.5 (high severity).

Exploitation of this vulnerability results in denial of service, where the Thumbor service becomes unresponsive or significantly delayed in processing new images due to the regex engine being overwhelmed by crafted input. There is no impact on confidentiality or integrity, only availability is affected.

A patch is available for this vulnerability. Users should upgrade Thumbor to version 7.8.0 or later where the regex issue in the convolution filter has been fixed. No other mitigation is indicated by the vendor advisory.