CVE-2026-53423

creationtimestamp| type| source ---|---|--- 2026-08-18 22:35:35+00:00| published-proof-of-concept| https://github.com/membraneframework/membranemp4plugin/security/advisories/GHSA-43hj-fxwj-49qw...

membrane_mp4_plugin has an unauthenticated denial-of-service via BEAM atom table exhaustion

Summary membranemp4plugin interns every 4-byte MP4 box name as a BEAM atom while parsing container headers, with no validation against an allow-list. Any code path that calls Membrane.MP4.Container.parse/1 or the bang variant on attacker-controlled MP4 bytes can be made to exhaust the BEAM atom...