CVE-2026-53423: Denial-of-Service via Atom Table Exhaustion in membrane_mp4_plugin
Summary
CVE-2026-53423: Unauthenticated denial-of-service via BEAM atom table exhaustion in membrane_mp4_plugin. Affects membrane_mp4_plugin across 2 version ranges.
>= 0.3.0, < 0.36.7
>= ae4bf04c393aa1562f3df3d33e20bc5cb8130de2, < 56373d1ddc86968e55fbde795c14eeba24357b57
Fixed in 0.36.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The membrane_mp4_plugin is a component of the Membrane Framework, designed for multimedia processing in Elixir applications. It facilitates the handling of MP4 files, enabling developers to build applications that can process audio and video content efficiently. However, this plugin has a vulnerability that allows unauthenticated users to exploit the system, leading to potential service disruptions.
Vulnerability Detail
The vulnerability arises from the allocation of resources without proper limits or throttling in the membrane_mp4_plugin. Specifically, the MP4 box header parser converts 4-byte box names into atoms using String.to_atom/1 without any validation. This process can lead to atom table exhaustion, as each unique box name is permanently allocated and never garbage-collected. An attacker can craft an MP4 file of approximately 8 MB containing around 1.1 million distinct box names, which can exhaust the atom table (default limit of 1,048,576 atoms), causing the entire BEAM node to abort and take down all applications running on it. The CVSS score for this vulnerability is 5.9.
How To Fix
Minimum fixed version
0.36.7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the input size of MP4 files processed by the application or implement validation checks on box names before they are converted to atoms. However, these measures may not fully mitigate the risk of denial-of-service attacks.
Conclusion
CVE-2026-53423 is a significant vulnerability in the membrane_mp4_plugin that can lead to denial-of-service attacks through atom table exhaustion. It is crucial for developers using this plugin to update to the patched version to ensure the security and stability of their applications. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for membrane_mp4_plugin →
FAQ
CVE-2026-53423 is a vulnerability in the membrane_mp4_plugin that allows unauthenticated denial-of-service attacks through atom table exhaustion.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against CVE-2026-53423 using the Vulert playground at Vulert Scanner.
Exploitation of this vulnerability can lead to service disruptions, as it can cause the BEAM node to abort, affecting all applications running on it.
Yes, the vulnerability has been patched in version 0.36.7 of the membrane_mp4_plugin. Updating to this version will resolve the issue.
If you cannot update immediately, consider implementing input size limits and validation checks on box names to mitigate the risk temporarily.
