CVE-2026-53423
Description
Allocation of Resources Without Limits or Throttling vulnerability in membraneframework membrane_mp4_plugin allows unauthenticated denial-of-service via BEAM atom table exhaustion. The MP4 box header parser converts each 4-byte box name to an atom using String.to_atom/1 without validation. 'Elixir.Membrane.MP4.Container.Header':parse_box_name/1 in lib/membrane_mp4/container/header.ex interns every box name encountered while 'Elixir.Membrane.MP4.Container.Header':parse/1 walks the input. BEAM atoms are never garbage-collected, so each unique attacker-controlled 4-byte name is a permanent allocation. A crafted MP4 of approximately 8 MB containing roughly 1.1 million boxes with distinct non-standard names exhausts the atom table (default ceiling around 1,048,576 atoms), aborting the entire BEAM node and taking down all applications running on it. This issue affects membrane_mp4_plugin from 0.3.0 before 0.36.7.
How to fix
- membraneframework membrane_mp4_plugin0.36.7, 56373d1ddc86968e55fbde795c14eeba24357b57 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| membraneframework membrane_mp4_plugin | 0.3.0 ≤ v < 0.36.7, ae4bf04c393aa1562f3df3d33e20bc5cb8130de2 ≤ v < 56373d1ddc86968e55fbde795c14eeba24357b57 | 0.36.7, 56373d1ddc86968e55fbde795c14eeba24357b57 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.