Security Advisory 2026-0023

Details

Denial of service vulnerability in the SRT/WebVTT subtitle parser (subparse) when processing subtitle files with long lines. The implementation used regular expressions for string matching and replacement with quadratic time complexity, causing severe performance degradation. Processing a 1kB line could take over 30 seconds due to this inefficient pattern matching.

Impact

A malicious third party could trigger a denial of service by providing a crafted subtitle file with long lines. This would cause excessive CPU usage and application unresponsiveness during subtitle parsing.

Solution

The gst-plugins-base 1.28.2 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer 1.28.2 release

• Release Notes
• GStreamer Plugins Base 1.28.2

Patches

• Patch