CyberRota Analysis
AI-GeneratedThe convolution filter in Thumbor versions prior to 7.8.0 is vulnerable to a denial-of-service attack due to exponential backtracking in its regular expression processing, which can be triggered by specially crafted numeric input. This vulnerability can lead to significant processing time exhaustion, impacting the availability of the service. Organizations using Thumbor for image processing should prioritize upgrading to version 7.8.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on crafted repeated numeric input, allowing a URL request to exhaust processing time. This issue is fixed in 7.8.0.