CVE 2026 125040

A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While sanitizing inline subtitle markup, the parser repeatedly searches the remaining text with unanchored regular expressions. A crafted subtitle cue with a long line of unmatched markup-like text can force quadratic CPU use and make a GStreamer-based application unresponsive.

Static review of gst-plugins-base 1.28.1 confirmed the quadratic parsing path in subrip_fix_up_markup(). Upstream states that 1.28.2 fixes the issue; the fixed source and runtime behavior were not checked in this verification. Red Hat product exposure remains unassessed.

Update gst-plugins-base to version 1.28.2 or later. Where updating is not yet possible, applications that do not require untrusted SRT/WebVTT subtitles can prevent automatic selection of the subparse element (for example, by setting GST_PLUGIN_FEATURE_RANK=subparse:NONE).

Bugzilla 2569124 : gst-plugins-base: gst-plugins-base: Quadratic regex processing in SRT/WebVTT subtitle parser causes denial of service

CWE-1333 : Inefficient Regular Expression Complexity

Common Vulnerability Scoring System (CVSS) Score Details

Info alert: Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications ).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 Score Breakdown

Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Red Hat CVSS v3 Score Explanation

Static Sonnet verification of gst-plugins-base 1.28.1: AV:N because crafted subtitle tracks can be delivered within network media streams to subparse; AV:L remains appropriate for deployments limited to manually opened local subtitle files. AC:L: one crafted long cue deterministically triggers quadratic regex scanning. PR:N: no account required. UI:R: the victim must play or open the media. S:U: CPU exhaustion remains in the parsing process. C:N and I:N: no disclosure or modification mechanism found. A:H: the unbounded scan can leave the application unresponsive. No dynamic timing test was run.

Understanding the Weakness (CWE)

Technical Impact: DoS: Resource Consumption (CPU)

Attackers can create crafted inputs that intentionally cause the regular expression to use excessive backtracking in a way that causes the CPU consumption to spike.

Frequently Asked Questions

"Under investigation" doesn't necessarily mean that the product is affected by this vulnerability. It only means that our Analysis Team is still working on determining whether the product is affected and how it is affected.

The term 'Affected' means that our Analysis team has determined that this product, such as Red Hat Enterprise Linux 8 or OpenShift Container Platform 4, is affected by this vulnerability and a fix may be released to address this issue in the near future. This includes all minor releases of this product unless noted otherwise in the Statement text.

Upgrade to a supported product version that includes a fix for this vulnerability (recommended).

Apply a mitigation (if one exists).

Customers with the Technical Account Manager (TAM) RHEL Security Select Add-on can review this CVE directly with their TAM.

Apply a mitigation (if one exists).

Red Hat Engineering focuses on addressing high-priority issues based on the impact and product lifecycle expectations. Therefore, lower-priority issues will not receive immediate fixes.

Customers with the technical account manager (TAM) RHEL Security Select Add-on can review this CVE directly with their TAM.

Not sure what something means? Check out our Security Glossary .

For clarification or corrections, please Red Hat Product Security .