{"id":"AZL-113356","summary":"CVE-2026-125040 affecting package gstreamer1-plugins-base 1.20.0-3","details":"A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While sanitizing inline subtitle markup, the parser repeatedly searches the remaining text with unanchored regular expressions. A crafted subtitle cue with a long line of unmatched markup-like text can force quadratic CPU use and make a GStreamer-based application unresponsive.","modified":"2026-11-13T14:17:22.496499178Z","published":"2026-11-09T19:16:48Z","upstream":["CVE-2026-125040"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125040"}],"affected":[{"package":{"name":"gstreamer1-plugins-base","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/gstreamer1-plugins-base"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.20.0-3"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-113356.json"}}],"schema_version":"1.9.2"}