A vulnerability in GStreamer's gst-plugins-base SRT and WebVTT subtitle parser allows an attacker to trigger quadratic CPU consumption during markup sanitization. By submitting a subtitle cue with a lengthy line of unmatched markup-like text, the parser repeatedly applies unanchored regular expressions to the remaining text, exhausting CPU resources and rendering the GStreamer-based application unresponsive. This flaw results in a denial‑of‑service condition and is categorized as CWE‑1333.

The flaw affects Red Hat Enterprise Linux distributions: RHEL 7 (including the ELS extension), RHEL 8, RHEL 9 and RHEL 10, which ship the GStreamer gst‑plugins‑base package. The affected component is the gstreamer‑plugins‑base suite; versions prior to the 1.28.2 release are vulnerable. Red Hat recommends upgrading to gst‑plugins‑base 1.28.2 or later to eliminate the issue. Administrators on systems where updating cannot be performed immediately can mitigate by preventing the automatic selection of the 'subparse' element (e.g., set GST_PLUGIN_FEATURE_RANK=subparse:NONE) or by disabling untrusted subtitle ingestion.

With a CVSS score of 6.5 the issue is classified as medium severity. No EPSS score is available, and it is not currently a known exploited vulnerability in the CISA KEV catalog, indicating a modest exploitation likelihood. The vulnerability can be triggered by any GStreamer‑based application that processes untrusted SRT or WebVTT subtitle cues. By submitting a crafted cue laden with long, unmatched markup, an attacker can force the parser to perform repeated, unanchored regex operations, leading the application to consume excessive CPU and become unresponsive. The attack therefore presents a denial‑of‑service condition that affects the targeted process and, if the application is a network service, can disrupt availability for all users interacting with that service.