1 matches found
membrane_mp4_plugin has an unauthenticated denial-of-service via BEAM atom table exhaustion
Summary membranemp4plugin interns every 4-byte MP4 box name as a BEAM atom while parsing container headers, with no validation against an allow-list. Any code path that calls Membrane.MP4.Container.parse/1 or the bang variant on attacker-controlled MP4 bytes can be made to exhaust the BEAM atom...
5.9CVSS5.4AI score0.00126EPSS
SaveExploits0References6Affected Software1
20