Most recent entries from all

EUVD-2026-326820

fkie_cve-2026-53423

Allocation of Resources Without Limits or Throttling vulnerability in membraneframework membrane_mp4_plugin allows unauthenticated denial-of-service via BEAM atom table exhaustion.

The MP4 box header parser converts each 4-byte box name to an atom using String.to_atom/1 without validation. 'Elixir.Membrane.MP4.Container.Header':parse_box_name/1 in lib/membrane_mp4/container/header.ex interns every box name encountered while 'Elixir.Membrane.MP4.Container.Header':parse/1 walks the input. BEAM atoms are never garbage-collected, so each unique attacker-controlled 4-byte name is a permanent allocation. A crafted MP4 of approximately 8 MB containing roughly 1.1 million boxes with distinct non-standard names exhausts the atom table (default ceiling around 1,048,576 atoms), aborting the entire BEAM node and taking down all applications running on it.

This issue affects membrane_mp4_plugin from 0.3.0 before 0.36.7.

GHSA-43hj-fxwj-49qw — membrane_mp4_plugin has an unauthenticated denial-of-service via BEAM atom table exhaustion

Affected: Hex: membrane_mp4_plugin

### Summary

`membrane_mp4_plugin` interns every 4-byte MP4 box name as a BEAM atom while parsing container headers, with no validation against an allow-list. Any code path that calls `Membrane.MP4.Container.parse/1` (or the bang variant) on attacker-controlled MP4 bytes can be made to exhaust the BEAM atom table, which is uncapped at the source but bounded by the runtime ceiling (around 1,048,576 atoms) and never garbage-collected. Once the ceiling is hit, the entire BEAM node aborts.

### Details

The MP4 container parser walks the input stream box-by-box. For each box, `Membrane.MP4.Container.Header.parse/1` in `lib/membrane_mp4/container/header.ex` extracts the 4-byte name field and delegates to the private helper `parse_box_name/1`, which trims trailing spaces and passes the bytes through `String.to_atom/1`. Because `String.to_atom/1` creates a new atom unconditionally, every distinct attacker-chosen 4-byte sequence becomes a permanent allocation in the global atom table. Atoms are not subject to garbage collection, so unique names accumulate for the lifetime of the node.

The fix replaces the unsafe interning with `String.to_existing_atom/1` and treats unknown names as the `:unknown` atom downstream (with related plumbing in `parse_helper.ex`, `serialize_helper.ex`, and the ISOM/CMAF demuxer engines so the new error variant flows through cleanly).

### PoC

1. Generate an MP4-shaped payload of roughly 1.1 million minimal box headers, each 8 bytes long (4-byte size of 8…