diff --git a/core/modules/media/src/OEmbed/ResourceFetcher.php b/core/modules/media/src/OEmbed/ResourceFetcher.php
index 534102cb592..c27a1f3ef79 100644
--- a/core/modules/media/src/OEmbed/ResourceFetcher.php
+++ b/core/modules/media/src/OEmbed/ResourceFetcher.php
@@ -7,6 +7,7 @@ use Drupal\Core\Cache\CacheBackendInterface;
 use Drupal\Core\Cache\UseCacheBackendTrait;
 use GuzzleHttp\ClientInterface;
 use GuzzleHttp\Exception\TransferException;
+use GuzzleHttp\RequestOptions;
 
 /**
  * Fetches and caches oEmbed resources.
@@ -58,7 +59,9 @@ class ResourceFetcher implements ResourceFetcherInterface {
     }
 
     try {
-      $response = $this->httpClient->get($url);
+      $response = $this->httpClient->request('GET', $url, [
+        RequestOptions::TIMEOUT => 5,
+      ]);
     }
     catch (TransferException $e) {
       throw new ResourceException('Could not retrieve the oEmbed resource.', $url, [], $e);
diff --git a/core/modules/media/tests/src/Unit/ResourceFetcherTest.php b/core/modules/media/tests/src/Unit/ResourceFetcherTest.php
index 0aef16ed5c0..709d268fb6d 100644
--- a/core/modules/media/tests/src/Unit/ResourceFetcherTest.php
+++ b/core/modules/media/tests/src/Unit/ResourceFetcherTest.php
@@ -10,6 +10,7 @@ use GuzzleHttp\Client;
 use GuzzleHttp\Handler\MockHandler;
 use GuzzleHttp\HandlerStack;
 use GuzzleHttp\Psr7\Response;
+use GuzzleHttp\RequestOptions;
 
 /**
  * @group media
@@ -18,6 +19,34 @@ use GuzzleHttp\Psr7\Response;
  */
 class ResourceFetcherTest extends UnitTestCase {
 
+  /**
+   * Tests that resources are fetched with a hard-coded timeout.
+   */
+  public function testFetchTimeout(): void {
+    $url = 'https://example.com/oembed?url=resource';
+    $headers = [
+      'Content-Type' => ['text/javascript'],
+    ];
+    $body = Json::encode([
+      'version' => '1.0',
+      'type' => 'video',
+      'html' => 'test',
+    ]);
+    $response = new Response(200, $headers, $body);
+
+    $client = $this->prophesize(Client::class);
+    $client->request('GET', $url, [RequestOptions::TIMEOUT => 5])
+      ->shouldBeCalled()
+      ->willReturn($response);
+
+    $fetcher = new ResourceFetcher(
+      $client->reveal(),
+      $this->createMock('\Drupal\media\OEmbed\ProviderRepositoryInterface'),
+      new NullBackend('default')
+    );
+    $fetcher->fetchResource($url);
+  }
+
   /**
    * Tests how the resource fetcher handles unknown Content-Type headers.
    *