REDHAT-BUG-2569124: Medium severity GStreamer gst-plugins-base vulnerability

Q: What input is required to trigger the excessive CPU use?

An attacker needs to provide a crafted SRT or WebVTT subtitle file containing long lines that trigger quadratic-time regular-expression matching and replacement in the subparse parser.

Q: Which systems are realistically exposed?

Applications that use GStreamer gst-plugins-base to parse untrusted or attacker-supplied SRT or WebVTT subtitle files are exposed to application unresponsiveness and excessive CPU consumption.

Q: What version contains the fix?

The issue is fixed in gst-plugins-base 1.28.2.

Published Nov 9, 2026

Updated

GStreamer-SA-2026-0023: The SRT/WebVTT subtitle parser (subparse) uses regular-expression matching and replacement with quadratic time complexity for long lines. A crafted subtitle file can cause excessive CPU use and application unresponsiveness. Fixed in gst-plugins-base 1.28.2.

Affected Software

1 affected component

GStreamer gst-plugins-base<1.28.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade gst-plugins-base to a version that resolves this vulnerability.
Fixed in 1.28.2

Event History

Nov 9, 2026

Data Sourced

via Red Hat·12:55 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What input is required to trigger the excessive CPU use?

An attacker needs to provide a crafted SRT or WebVTT subtitle file containing long lines that trigger quadratic-time regular-expression matching and replacement in the subparse parser.

Which systems are realistically exposed?

Applications that use GStreamer gst-plugins-base to parse untrusted or attacker-supplied SRT or WebVTT subtitle files are exposed to application unresponsiveness and excessive CPU consumption.

What version contains the fix?

The issue is fixed in gst-plugins-base 1.28.2.

REDHAT-BUG-2569124: Medium severity GStreamer gst-plugins-base vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What input is required to trigger the excessive CPU use?

Which systems are realistically exposed?

What version contains the fix?

Company

Resources

Contact

Frequently Asked Questions

What input is required to trigger the excessive CPU use?

Which systems are realistically exposed?

What version contains the fix?