membraneframework membrane_mp4_plugin up to 0.36.6 header.ex allocation of resources

Summaryinfo

A vulnerability identified as problematic has been detected in membraneframework membrane_mp4_plugin up to 0.36.6. The affected element is an unknown function in the library lib/membrane_mp4/container/header.ex. Performing a manipulation results in allocation of resources. This vulnerability is known as CVE-2026-53423. Attacking locally is a requirement. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in membraneframework membrane_mp4_plugin up to 0.36.6. It has been classified as problematic. This affects some unknown functionality in the library lib/membrane_mp4/container/header.ex. The manipulation with an unknown input leads to a allocation of resources vulnerability. CWE is classifying the issue as CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. This is going to have an impact on availability. The summary by CVE is:

Allocation of Resources Without Limits or Throttling vulnerability in membraneframework membrane_mp4_plugin allows unauthenticated denial-of-service via BEAM atom table exhaustion. The MP4 box header parser converts each 4-byte box name to an atom using String.to_atom/1 without validation. 'Elixir.Membrane.MP4.Container.Header':parse_box_name/1 in lib/membrane_mp4/container/header.ex interns every box name encountered while 'Elixir.Membrane.MP4.Container.Header':parse/1 walks the input. BEAM atoms are never garbage-collected, so each unique attacker-controlled 4-byte name is a permanent allocation. A crafted MP4 of approximately 8 MB containing roughly 1.1 million boxes with distinct non-standard names exhausts the atom table (default ceiling around 1,048,576 atoms), aborting the entire BEAM node and taking down all applications running on it. This issue affects membrane_mp4_plugin from 0.3.0 before 0.36.7.

The weakness was published by Łukasz Kita and Jonatan Männchen as GHSA-43hj-fxwj-49qw. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-53423 since 06/09/2026. The exploitability is told to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available.

Upgrading to version 0.36.7 eliminates this vulnerability. Applying the patch 56373d1ddc86968e55fbde795c14eeba24357b57 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• membraneframework

Name

• membrane_mp4_plugin

Version

• 0.36.0
• 0.36.1
• 0.36.2
• 0.36.3
• 0.36.4
• 0.36.5
• 0.36.6

License

• open-source

Website

• Product: https://github.com/membraneframework/membrane_mp4_plugin/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion