{"affected":[{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gstreamer1-plugins-base","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gstreamer1-plugins-base","product":"Red Hat Enterprise Linux 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gstreamer1-plugins-base","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gstreamer1-plugins-base","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-125040","cwes":["CWE-1333"],"description":"A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While sanitizing inline subtitle markup, the parser repeatedly searches the remaining text with unanchored regular expressions. A crafted subtitle cue with a long line of unmatched markup-like text can force quadratic CPU use and make a GStreamer-based application unresponsive.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.5,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1794249692861,"publishedAt":1794248210987,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-125040"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2569124"},{"source":"CNA: redhat","tags":[],"url":"https://gstreamer.freedesktop.org/security/sa-2026-0023.html"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Update gst-plugins-base to version 1.28.2 or later. Where updating is not yet possible, applications that do not require untrusted SRT/WebVTT subtitles can prevent automatic selection of the subparse element (for example, by setting GST_PLUGIN_FEATURE_RANK=subparse:NONE)."}],"revision":"ee613f1e0ca4503e82260229ffcfd8cc977aeca7549286719d8315f8e1ef61a8","sources":[{"modifiedAt":1794249692861,"name":"CNA: redhat","retrievedAt":1794251346032,"url":"https://www.cve.org/CVERecord?id=CVE-2026-125040"}],"ssvc":{"assessedAt":1794249660538,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Gst-plugins-base: gst-plugins-base: quadratic regex processing in srt/webvtt subtitle parser causes denial of service","updatedAt":1794251346032}