Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter
Modified: 8/4/2026
package
pkg:pypi/thumbor
Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter
Modified: 8/4/2026
Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot
Modified: 8/4/2026
Thumbor has path traversal via post-validation URL decoding bypass in file_loader
Modified: 8/4/2026
Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS
Modified: 8/4/2026
Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature
Modified: 8/4/2026
Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS
Modified: 8/4/2026
Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter
Modified: 8/4/2026
Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot
Modified: 8/4/2026
Thumbor has path traversal via post-validation URL decoding bypass in file_loader
Modified: 8/4/2026
Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS
Modified: 8/4/2026
Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature
Modified: 8/4/2026
Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS
Modified: 8/4/2026