PT-2026-48648 · Membraneframework · Membrane Mp4 Plugin

Łukasz Kita + 1 · Published 2026-06-11 · Updated 2026-06-11 · CVE-2026-53423

NVD

CVSS v4.0

5.9

Medium

Base vector

AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Allocation of Resources Without Limits or Throttling vulnerability in membraneframework membrane mp4 plugin allows unauthenticated denial-of-service via BEAM atom table exhaustion.

The MP4 box header parser converts each 4-byte box name to an atom using String.to atom/1 without validation. 'Elixir.Membrane.MP4.Container.Header':parse box name/1 in lib/membrane mp4/container/header.ex interns every box name encountered while 'Elixir.Membrane.MP4.Container.Header':parse/1 walks the input. BEAM atoms are never garbage-collected, so each unique attacker-controlled 4-byte name is a permanent allocation. A crafted MP4 of approximately 8 MB containing roughly 1.1 million boxes with distinct non-standard names exhausts the atom table (default ceiling around 1,048,576 atoms), aborting the entire BEAM node and taking down all applications running on it.

This issue affects membrane mp4 plugin from 0.3.0 before 0.36.7.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-53423

Affected Products

Membrane Mp4 Plugin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-53423 · Security Note
• https://github.com/membraneframework/membrane_mp4_plugin/commit/56373d1ddc86968e55fbde795c14eeba24357b57 · Patch
• https://github.com/membraneframework/membrane_mp4_plugin/security/advisories/GHSA-43hj-fxwj-49qw · Vendor Advisory
• https://osv.dev/vulnerability/EEF-CVE-2026-53423 · Note
• https://cna.erlef.org/cves/CVE-2026-53423.html · Note