Vulnerability-Lookup

CVE-2026-53423 (GCVE-0-2026-53423)

Vulnerability from cvelistv5 – Published: 2026-06-11 10:44 – Updated: 2026-06-12 04:45

Title

Unauthenticated denial-of-service via BEAM atom table exhaustion in membrane_mp4_plugin

Summary

Allocation of Resources Without Limits or Throttling vulnerability in membraneframework membrane_mp4_plugin allows unauthenticated denial-of-service via BEAM atom table exhaustion. The MP4 box header parser converts each 4-byte box name to an atom using String.to_atom/1 without validation. 'Elixir.Membrane.MP4.Container.Header':parse_box_name/1 in lib/membrane_mp4/container/header.ex interns every box name encountered while 'Elixir.Membrane.MP4.Container.Header':parse/1 walks the input. BEAM atoms are never garbage-collected, so each unique attacker-controlled 4-byte name is a permanent allocation. A crafted MP4 of approximately 8 MB containing roughly 1.1 million boxes with distinct non-standard names exhausts the atom table (default ceiling around 1,048,576 atoms), aborting the entire BEAM node and taking down all applications running on it. This issue affects membrane_mp4_plugin from 0.3.0 before 0.36.7.

Severity

5.9 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-11 12:09 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

EEF CNA under the mitre root

CNA scorecard A 96/100 over 316 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/membraneframework/membrane_mp4…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-53423.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-53423	related
https://github.com/membraneframework/membrane_mp4…	patch

Impacted products

2 products

Vendor	Product	Version	CPE status
membraneframework	membrane_mp4_plugin	Affected: 0.3.0 , < 0.36.7 (semver) cpe:2.3:a:membraneframework:membrane_mp4_plugin::::::::
membraneframework	membrane_mp4_plugin	Affected: ae4bf04c393aa1562f3df3d33e20bc5cb8130de2 , < 56373d1ddc86968e55fbde795c14eeba24357b57 (git) cpe:2.3:a:membraneframework:membrane_mp4_plugin::::::::

Credits

Łukasz Kita Łukasz Kita Mateusz Front Jonatan Männchen / EEF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-53423",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-11T12:09:51.183359Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T12:11:18.865Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/membraneframework/membrane_mp4_plugin/security/advisories/GHSA-43hj-fxwj-49qw"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:membraneframework:membrane_mp4_plugin:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "Elixir.Membrane.MP4.Container.Header"
          ],
          "packageName": "membrane_mp4_plugin",
          "packageURL": "pkg:hex/membrane_mp4_plugin",
          "product": "membrane_mp4_plugin",
          "programFiles": [
            "lib/membrane_mp4/container/header.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Membrane.MP4.Container.Header\u0027:parse/1"
            },
            {
              "name": "\u0027Elixir.Membrane.MP4.Container.Header\u0027:parse_box_name/1"
            }
          ],
          "repo": "https://github.com/membraneframework/membrane_mp4_plugin",
          "vendor": "membraneframework",
          "versions": [
            {
              "lessThan": "0.36.7",
              "status": "affected",
              "version": "0.3.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:membraneframework:membrane_mp4_plugin:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "Elixir.Membrane.MP4.Container.Header"
          ],
          "packageName": "membraneframework/membrane_mp4_plugin",
          "packageURL": "pkg:github/membraneframework/membrane_mp4_plugin",
          "product": "membrane_mp4_plugin",
          "programFiles": [
            "lib/membrane_mp4/container/header.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Membrane.MP4.Container.Header\u0027:parse/1"
            },
            {
              "name": "\u0027Elixir.Membrane.MP4.Container.Header\u0027:parse_box_name/1"
            }
          ],
          "repo": "https://github.com/membraneframework/membrane_mp4_plugin",
          "vendor": "membraneframework",
          "versions": [
            {
              "lessThan": "56373d1ddc86968e55fbde795c14eeba24357b57",
              "status": "affected",
              "version": "ae4bf04c393aa1562f3df3d33e20bc5cb8130de2",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:membraneframework:membrane_mp4_plugin:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.36.7",
                  "versionStartIncluding": "0.3.0",
                  "vulnerable": true
                }
              ],
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "\u0141ukasz Kita"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "\u0141ukasz Kita"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Mateusz Front"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in membraneframework membrane_mp4_plugin allows unauthenticated denial-of-service via BEAM atom table exhaustion.\u003c/p\u003e\u003cp\u003eThe MP4 box header parser converts each 4-byte box name to an atom using \u003ctt\u003eString.to_atom/1\u003c/tt\u003e without validation. \u003ctt\u003e\u0027Elixir.Membrane.MP4.Container.Header\u0027:parse_box_name/1\u003c/tt\u003e in \u003ctt\u003elib/membrane_mp4/container/header.ex\u003c/tt\u003e interns every box name encountered while \u003ctt\u003e\u0027Elixir.Membrane.MP4.Container.Header\u0027:parse/1\u003c/tt\u003e walks the input. BEAM atoms are never garbage-collected, so each unique attacker-controlled 4-byte name is a permanent allocation. A crafted MP4 of approximately 8 MB containing roughly 1.1 million boxes with distinct non-standard names exhausts the atom table (default ceiling around 1,048,576 atoms), aborting the entire BEAM node and taking down all applications running on it.\u003c/p\u003e\u003cp\u003eThis issue affects membrane_mp4_plugin from 0.3.0 before 0.36.7.\u003c/p\u003e"
            }
          ],
          "value": "Allocation of Resources Without Limits or Throttling vulnerability in membraneframework membrane_mp4_plugin allows unauthenticated denial-of-service via BEAM atom table exhaustion.\n\nThe MP4 box header parser converts each 4-byte box name to an atom using String.to_atom/1 without validation. \u0027Elixir.Membrane.MP4.Container.Header\u0027:parse_box_name/1 in lib/membrane_mp4/container/header.ex interns every box name encountered while \u0027Elixir.Membrane.MP4.Container.Header\u0027:parse/1 walks the input. BEAM atoms are never garbage-collected, so each unique attacker-controlled 4-byte name is a permanent allocation. A crafted MP4 of approximately 8 MB containing roughly 1.1 million boxes with distinct non-standard names exhausts the atom table (default ceiling around 1,048,576 atoms), aborting the entire BEAM node and taking down all applications running on it.\n\nThis issue affects membrane_mp4_plugin from 0.3.0 before 0.36.7."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-12T04:45:33.275Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/membraneframework/membrane_mp4_plugin/security/advisories/GHSA-43hj-fxwj-49qw"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-53423.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-53423"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/membraneframework/membrane_mp4_plugin/commit/56373d1ddc86968e55fbde795c14eeba24357b57"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Unauthenticated denial-of-service via BEAM atom table exhaustion in membrane_mp4_plugin",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-53423",
    "datePublished": "2026-06-11T10:44:51.528Z",
    "dateReserved": "2026-06-09T11:01:47.529Z",
    "dateUpdated": "2026-06-12T04:45:33.275Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53423",
      "date": "2026-10-22",
      "epss": "0.0018",
      "percentile": "0.07187"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://repo.hex.pm",
                "cpes": [
                  "cpe:2.3:a:membraneframework:membrane_mp4_plugin:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "Elixir.Membrane.MP4.Container.Header"
                ],
                "packageName": "membrane_mp4_plugin",
                "packageURL": "pkg:hex/membrane_mp4_plugin",
                "product": "membrane_mp4_plugin",
                "programFiles": [
                  "lib/membrane_mp4/container/header.ex"
                ],
                "programRoutines": [
                  {
                    "name": "\u0027Elixir.Membrane.MP4.Container.Header\u0027:parse/1"
                  },
                  {
                    "name": "\u0027Elixir.Membrane.MP4.Container.Header\u0027:parse_box_name/1"
                  }
                ],
                "repo": "https://github.com/membraneframework/membrane_mp4_plugin",
                "vendor": "membraneframework",
                "versions": [
                  {
                    "lessThan": "0.36.7",
                    "status": "affected",
                    "version": "0.3.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "collectionURL": "https://github.com",
                "cpes": [
                  "cpe:2.3:a:membraneframework:membrane_mp4_plugin:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "Elixir.Membrane.MP4.Container.Header"
                ],
                "packageName": "membraneframework/membrane_mp4_plugin",
                "packageURL": "pkg:github/membraneframework/membrane_mp4_plugin",
                "product": "membrane_mp4_plugin",
                "programFiles": [
                  "lib/membrane_mp4/container/header.ex"
                ],
                "programRoutines": [
                  {
                    "name": "\u0027Elixir.Membrane.MP4.Container.Header\u0027:parse/1"
                  },
                  {
                    "name": "\u0027Elixir.Membrane.MP4.Container.Header\u0027:parse_box_name/1"
                  }
                ],
                "repo": "https://github.com/membraneframework/membrane_mp4_plugin",
                "vendor": "membraneframework",
                "versions": [
                  {
                    "lessThan": "56373d1ddc86968e55fbde795c14eeba24357b57",
                    "status": "affected",
                    "version": "ae4bf04c393aa1562f3df3d33e20bc5cb8130de2",
                    "versionType": "git"
                  }
                ]
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Allocation of Resources Without Limits or Throttling vulnerability in membraneframework membrane_mp4_plugin allows unauthenticated denial-of-service via BEAM atom table exhaustion.\n\nThe MP4 box header parser converts each 4-byte box name to an atom using String.to_atom/1 without validation. \u0027Elixir.Membrane.MP4.Container.Header\u0027:parse_box_name/1 in lib/membrane_mp4/container/header.ex interns every box name encountered while \u0027Elixir.Membrane.MP4.Container.Header\u0027:parse/1 walks the input. BEAM atoms are never garbage-collected, so each unique attacker-controlled 4-byte name is a permanent allocation. A crafted MP4 of approximately 8 MB containing roughly 1.1 million boxes with distinct non-standard names exhausts the atom table (default ceiling around 1,048,576 atoms), aborting the entire BEAM node and taking down all applications running on it.\n\nThis issue affects membrane_mp4_plugin from 0.3.0 before 0.36.7."
          }
        ],
        "id": "CVE-2026-53423",
        "lastModified": "2026-06-17T10:57:54.680",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "LOCAL",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 5.9,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-53423",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-11T12:09:51.183359Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-06-11T12:16:31.810",
        "references": [
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://cna.erlef.org/cves/CVE-2026-53423.html"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/membraneframework/membrane_mp4_plugin/commit/56373d1ddc86968e55fbde795c14eeba24357b57"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/membraneframework/membrane_mp4_plugin/security/advisories/GHSA-43hj-fxwj-49qw"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://osv.dev/vulnerability/EEF-CVE-2026-53423"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/membraneframework/membrane_mp4_plugin/security/advisories/GHSA-43hj-fxwj-49qw"
          }
        ],
        "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-770"
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-53423",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-11T12:09:51.183359Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-11T12:09:36.211Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/membraneframework/membrane_mp4_plugin/security/advisories/GHSA-43hj-fxwj-49qw"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://repo.hex.pm",
              "cpes": [
                "cpe:2.3:a:membraneframework:membrane_mp4_plugin:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "Elixir.Membrane.MP4.Container.Header"
              ],
              "packageName": "membrane_mp4_plugin",
              "packageURL": "pkg:hex/membrane_mp4_plugin",
              "product": "membrane_mp4_plugin",
              "programFiles": [
                "lib/membrane_mp4/container/header.ex"
              ],
              "programRoutines": [
                {
                  "name": "\u0027Elixir.Membrane.MP4.Container.Header\u0027:parse/1"
                },
                {
                  "name": "\u0027Elixir.Membrane.MP4.Container.Header\u0027:parse_box_name/1"
                }
              ],
              "repo": "https://github.com/membraneframework/membrane_mp4_plugin",
              "vendor": "membraneframework",
              "versions": [
                {
                  "lessThan": "0.36.7",
                  "status": "affected",
                  "version": "0.3.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "collectionURL": "https://github.com",
              "cpes": [
                "cpe:2.3:a:membraneframework:membrane_mp4_plugin:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "Elixir.Membrane.MP4.Container.Header"
              ],
              "packageName": "membraneframework/membrane_mp4_plugin",
              "packageURL": "pkg:github/membraneframework/membrane_mp4_plugin",
              "product": "membrane_mp4_plugin",
              "programFiles": [
                "lib/membrane_mp4/container/header.ex"
              ],
              "programRoutines": [
                {
                  "name": "\u0027Elixir.Membrane.MP4.Container.Header\u0027:parse/1"
                },
                {
                  "name": "\u0027Elixir.Membrane.MP4.Container.Header\u0027:parse_box_name/1"
                }
              ],
              "repo": "https://github.com/membraneframework/membrane_mp4_plugin",
              "vendor": "membraneframework",
              "versions": [
                {
                  "lessThan": "56373d1ddc86968e55fbde795c14eeba24357b57",
                  "status": "affected",
                  "version": "ae4bf04c393aa1562f3df3d33e20bc5cb8130de2",
                  "versionType": "git"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:membraneframework:membrane_mp4_plugin:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "0.36.7",
                      "versionStartIncluding": "0.3.0",
                      "vulnerable": true
                    }
                  ],
                  "operator": "OR"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "\u0141ukasz Kita"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "\u0141ukasz Kita"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Mateusz Front"
            },
            {
              "lang": "en",
              "type": "analyst",
              "value": "Jonatan M\u00e4nnchen / EEF"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in membraneframework membrane_mp4_plugin allows unauthenticated denial-of-service via BEAM atom table exhaustion.\u003c/p\u003e\u003cp\u003eThe MP4 box header parser converts each 4-byte box name to an atom using \u003ctt\u003eString.to_atom/1\u003c/tt\u003e without validation. \u003ctt\u003e\u0027Elixir.Membrane.MP4.Container.Header\u0027:parse_box_name/1\u003c/tt\u003e in \u003ctt\u003elib/membrane_mp4/container/header.ex\u003c/tt\u003e interns every box name encountered while \u003ctt\u003e\u0027Elixir.Membrane.MP4.Container.Header\u0027:parse/1\u003c/tt\u003e walks the input. BEAM atoms are never garbage-collected, so each unique attacker-controlled 4-byte name is a permanent allocation. A crafted MP4 of approximately 8 MB containing roughly 1.1 million boxes with distinct non-standard names exhausts the atom table (default ceiling around 1,048,576 atoms), aborting the entire BEAM node and taking down all applications running on it.\u003c/p\u003e\u003cp\u003eThis issue affects membrane_mp4_plugin from 0.3.0 before 0.36.7.\u003c/p\u003e"
                }
              ],
              "value": "Allocation of Resources Without Limits or Throttling vulnerability in membraneframework membrane_mp4_plugin allows unauthenticated denial-of-service via BEAM atom table exhaustion.\n\nThe MP4 box header parser converts each 4-byte box name to an atom using String.to_atom/1 without validation. \u0027Elixir.Membrane.MP4.Container.Header\u0027:parse_box_name/1 in lib/membrane_mp4/container/header.ex interns every box name encountered while \u0027Elixir.Membrane.MP4.Container.Header\u0027:parse/1 walks the input. BEAM atoms are never garbage-collected, so each unique attacker-controlled 4-byte name is a permanent allocation. A crafted MP4 of approximately 8 MB containing roughly 1.1 million boxes with distinct non-standard names exhausts the atom table (default ceiling around 1,048,576 atoms), aborting the entire BEAM node and taking down all applications running on it.\n\nThis issue affects membrane_mp4_plugin from 0.3.0 before 0.36.7."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-130",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-130 Excessive Allocation"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "LOCAL",
                "baseScore": 5.9,
                "baseSeverity": "MEDIUM",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-770",
                  "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-06-12T04:45:33.275Z",
            "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "shortName": "EEF"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory",
                "related"
              ],
              "url": "https://github.com/membraneframework/membrane_mp4_plugin/security/advisories/GHSA-43hj-fxwj-49qw"
            },
            {
              "tags": [
                "related"
              ],
              "url": "https://cna.erlef.org/cves/CVE-2026-53423.html"
            },
            {
              "tags": [
                "related"
              ],
              "url": "https://osv.dev/vulnerability/EEF-CVE-2026-53423"
            },
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/membraneframework/membrane_mp4_plugin/commit/56373d1ddc86968e55fbde795c14eeba24357b57"
            }
          ],
          "source": {
            "discovery": "INTERNAL"
          },
          "title": "Unauthenticated denial-of-service via BEAM atom table exhaustion in membrane_mp4_plugin",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "assignerShortName": "EEF",
        "cveId": "CVE-2026-53423",
        "datePublished": "2026-06-11T10:44:51.528Z",
        "dateReserved": "2026-06-09T11:01:47.529Z",
        "dateUpdated": "2026-06-12T04:45:33.275Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-53423

Vulnerability from fkie_nvd - Published: 2026-06-11 12:16 - Updated: 2026-06-17 10:57

Severity

5.9 (Medium) - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://cna.erlef.org/cves/CVE-2026-53423.html
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/membraneframework/membrane_mp4_plugin/commit/56373d1ddc86968e55fbde795c14eeba24357b57
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/membraneframework/membrane_mp4_plugin/security/advisories/GHSA-43hj-fxwj-49qw
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://osv.dev/vulnerability/EEF-CVE-2026-53423
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/membraneframework/membrane_mp4_plugin/security/advisories/GHSA-43hj-fxwj-49qw

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:membraneframework:membrane_mp4_plugin:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "Elixir.Membrane.MP4.Container.Header"
          ],
          "packageName": "membrane_mp4_plugin",
          "packageURL": "pkg:hex/membrane_mp4_plugin",
          "product": "membrane_mp4_plugin",
          "programFiles": [
            "lib/membrane_mp4/container/header.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Membrane.MP4.Container.Header\u0027:parse/1"
            },
            {
              "name": "\u0027Elixir.Membrane.MP4.Container.Header\u0027:parse_box_name/1"
            }
          ],
          "repo": "https://github.com/membraneframework/membrane_mp4_plugin",
          "vendor": "membraneframework",
          "versions": [
            {
              "lessThan": "0.36.7",
              "status": "affected",
              "version": "0.3.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:membraneframework:membrane_mp4_plugin:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "Elixir.Membrane.MP4.Container.Header"
          ],
          "packageName": "membraneframework/membrane_mp4_plugin",
          "packageURL": "pkg:github/membraneframework/membrane_mp4_plugin",
          "product": "membrane_mp4_plugin",
          "programFiles": [
            "lib/membrane_mp4/container/header.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Membrane.MP4.Container.Header\u0027:parse/1"
            },
            {
              "name": "\u0027Elixir.Membrane.MP4.Container.Header\u0027:parse_box_name/1"
            }
          ],
          "repo": "https://github.com/membraneframework/membrane_mp4_plugin",
          "vendor": "membraneframework",
          "versions": [
            {
              "lessThan": "56373d1ddc86968e55fbde795c14eeba24357b57",
              "status": "affected",
              "version": "ae4bf04c393aa1562f3df3d33e20bc5cb8130de2",
              "versionType": "git"
            }
          ]
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Allocation of Resources Without Limits or Throttling vulnerability in membraneframework membrane_mp4_plugin allows unauthenticated denial-of-service via BEAM atom table exhaustion.\n\nThe MP4 box header parser converts each 4-byte box name to an atom using String.to_atom/1 without validation. \u0027Elixir.Membrane.MP4.Container.Header\u0027:parse_box_name/1 in lib/membrane_mp4/container/header.ex interns every box name encountered while \u0027Elixir.Membrane.MP4.Container.Header\u0027:parse/1 walks the input. BEAM atoms are never garbage-collected, so each unique attacker-controlled 4-byte name is a permanent allocation. A crafted MP4 of approximately 8 MB containing roughly 1.1 million boxes with distinct non-standard names exhausts the atom table (default ceiling around 1,048,576 atoms), aborting the entire BEAM node and taking down all applications running on it.\n\nThis issue affects membrane_mp4_plugin from 0.3.0 before 0.36.7."
    }
  ],
  "id": "CVE-2026-53423",
  "lastModified": "2026-06-17T10:57:54.680",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "LOCAL",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-53423",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-11T12:09:51.183359Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-11T12:16:31.810",
  "references": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://cna.erlef.org/cves/CVE-2026-53423.html"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/membraneframework/membrane_mp4_plugin/commit/56373d1ddc86968e55fbde795c14eeba24357b57"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/membraneframework/membrane_mp4_plugin/security/advisories/GHSA-43hj-fxwj-49qw"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-53423"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/membraneframework/membrane_mp4_plugin/security/advisories/GHSA-43hj-fxwj-49qw"
    }
  ],
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary"
    }
  ]
}

GHSA-43HJ-FXWJ-49QW

Vulnerability from github – Published: 2026-08-18 20:16 – Updated: 2026-08-18 20:16

Summary

membrane_mp4_plugin has an unauthenticated denial-of-service via BEAM atom table exhaustion

Details

Summary

membrane_mp4_plugin interns every 4-byte MP4 box name as a BEAM atom while parsing container headers, with no validation against an allow-list. Any code path that calls Membrane.MP4.Container.parse/1 (or the bang variant) on attacker-controlled MP4 bytes can be made to exhaust the BEAM atom table, which is uncapped at the source but bounded by the runtime ceiling (around 1,048,576 atoms) and never garbage-collected. Once the ceiling is hit, the entire BEAM node aborts.

Details

The MP4 container parser walks the input stream box-by-box. For each box, Membrane.MP4.Container.Header.parse/1 in lib/membrane_mp4/container/header.ex extracts the 4-byte name field and delegates to the private helper parse_box_name/1, which trims trailing spaces and passes the bytes through String.to_atom/1. Because String.to_atom/1 creates a new atom unconditionally, every distinct attacker-chosen 4-byte sequence becomes a permanent allocation in the global atom table. Atoms are not subject to garbage collection, so unique names accumulate for the lifetime of the node.

The fix replaces the unsafe interning with String.to_existing_atom/1 and treats unknown names as the :unknown atom downstream (with related plumbing in parse_helper.ex, serialize_helper.ex, and the ISOM/CMAF demuxer engines so the new error variant flows through cleanly).

PoC

Generate an MP4-shaped payload of roughly 1.1 million minimal box headers, each 8 bytes long (4-byte size of 8, followed by a unique 4-byte ASCII name produced by enumerating combinations in the printable range).
Concatenate them into a single binary (~8 MB total).
Call Membrane.MP4.Container.parse!/1 on the binary inside any process running under the target BEAM node.
The node aborts once the atom table ceiling is reached.

Impact

An attacker who can get a single crafted MP4 file in front of any system that demuxes user-supplied media with membrane_mp4_plugin can crash the entire BEAM node hosting that pipeline, taking down every Erlang/Elixir application sharing the runtime. No authentication, network position, or user interaction is required beyond delivering the file to whatever processing path eventually calls the parser.

References

Introduction commit: https://github.com/membraneframework/membrane_mp4_plugin/commit/ae4bf04c393aa1562f3df3d33e20bc5cb8130de2
Patch commit: https://github.com/membraneframework/membrane_mp4_plugin/commit/56373d1ddc86968e55fbde795c14eeba24357b57

Severity

5.9 (Medium)


                  
                    CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Hex",
        "name": "membrane_mp4_plugin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.36.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53423"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-18T20:16:29Z",
    "nvd_published_at": "2026-06-11T12:16:31Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\n`membrane_mp4_plugin` interns every 4-byte MP4 box name as a BEAM atom while parsing container headers, with no validation against an allow-list. Any code path that calls `Membrane.MP4.Container.parse/1` (or the bang variant) on attacker-controlled MP4 bytes can be made to exhaust the BEAM atom table, which is uncapped at the source but bounded by the runtime ceiling (around 1,048,576 atoms) and never garbage-collected. Once the ceiling is hit, the entire BEAM node aborts.\n\n### Details\n\nThe MP4 container parser walks the input stream box-by-box. For each box, `Membrane.MP4.Container.Header.parse/1` in `lib/membrane_mp4/container/header.ex` extracts the 4-byte name field and delegates to the private helper `parse_box_name/1`, which trims trailing spaces and passes the bytes through `String.to_atom/1`. Because `String.to_atom/1` creates a new atom unconditionally, every distinct attacker-chosen 4-byte sequence becomes a permanent allocation in the global atom table. Atoms are not subject to garbage collection, so unique names accumulate for the lifetime of the node.\n\nThe fix replaces the unsafe interning with `String.to_existing_atom/1` and treats unknown names as the `:unknown` atom downstream (with related plumbing in `parse_helper.ex`, `serialize_helper.ex`, and the ISOM/CMAF demuxer engines so the new error variant flows through cleanly).\n\n### PoC\n\n1. Generate an MP4-shaped payload of roughly 1.1 million minimal box headers, each 8 bytes long (4-byte size of 8, followed by a unique 4-byte ASCII name produced by enumerating combinations in the printable range).\n2. Concatenate them into a single binary (~8 MB total).\n3. Call `Membrane.MP4.Container.parse!/1` on the binary inside any process running under the target BEAM node.\n4. The node aborts once the atom table ceiling is reached.\n\n### Impact\n\nAn attacker who can get a single crafted MP4 file in front of any system that demuxes user-supplied media with `membrane_mp4_plugin` can crash the entire BEAM node hosting that pipeline, taking down every Erlang/Elixir application sharing the runtime. No authentication, network position, or user interaction is required beyond delivering the file to whatever processing path eventually calls the parser.\n\n### References\n\n* Introduction commit: https://github.com/membraneframework/membrane_mp4_plugin/commit/ae4bf04c393aa1562f3df3d33e20bc5cb8130de2\n* Patch commit: https://github.com/membraneframework/membrane_mp4_plugin/commit/56373d1ddc86968e55fbde795c14eeba24357b57",
  "id": "GHSA-43hj-fxwj-49qw",
  "modified": "2026-08-18T20:16:29Z",
  "published": "2026-08-18T20:16:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/membraneframework/membrane_mp4_plugin/security/advisories/GHSA-43hj-fxwj-49qw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53423"
    },
    {
      "type": "WEB",
      "url": "https://github.com/membraneframework/membrane_mp4_plugin/commit/56373d1ddc86968e55fbde795c14eeba24357b57"
    },
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-53423.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/membraneframework/membrane_mp4_plugin"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-53423"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "membrane_mp4_plugin has an unauthenticated denial-of-service via BEAM atom table exhaustion"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-53423 (GCVE-0-2026-53423)

FKIE_CVE-2026-53423

GHSA-43HJ-FXWJ-49QW

Summary

Details

PoC

Impact

References

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour