A vulnerability, identified as CVE-2026-53423 with a CVSS score of 5.9, exists in the membrane_mp4_plugin module. This flaw allows an attacker to crash the entire BEAM node hosting that pipeline through an unauthenticated denial-of-service attack by exhausting the BEAM atom table. The issue occurs when the MP4 container parser processes the input stream box-by-box and extracts the 4-byte name field without validating it against an allow-list, resulting in permanent allocations in the global atom table for every distinct attacker-controlled 4-byte sequence. The vulnerability can be exploited by delivering a specially crafted MP4 file to systems that demux user-supplied media using this plugin, causing the BEAM node to crash and impacting all Erlang/Elixir applications sharing the same runtime.
We recommend you to update membrane_mp4_plugin to version 0.36.10 or later.[/subscribe_to_unlock_form]
A vulnerability, identified as CVE-2026-53423 with a CVSS score of 5.9, exists in the membrane_mp4_plugin module. This flaw allows an attacker to crash the entire BEAM node hosting that pipeline through an unauthenticated denial-of-service attack by exhausting the BEAM atom table. The issue occurs when the MP4 container parser processes the input stream box-by-box and extracts the 4-byte name field without validating it against an allow-list, resulting in permanent allocations in the global atom table for every distinct attacker-controlled 4-byte sequence. The vulnerability can be exploited by delivering a specially crafted MP4 file to systems that demux user-supplied media using this plugin, causing the BEAM node to crash and impacting all Erlang/Elixir applications sharing the same runtime.
We recommend you to update membrane_mp4_plugin to version 0.36.10 or later.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]