Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-125040

Gst-plugins-base: gst-plugins-base: quadratic regex processing in srt/webvtt subtitle parser causes denial of service

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While sanitizing inline subtitle markup, the parser repeatedly searches the remaining text with unanchored regular expressions. A crafted subtitle cue with a long line of unmatched markup-like text can force quadratic CPU use and make a GStreamer-based application unresponsive.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat Enterprise Linux 10

Default version status: affected

Red Hat Red Hat Enterprise Linux 7

Default version status: affected

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

References