vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-42792

epmd permanent DoS via EMFILE on accept(2) in erts

HIGH
7.5
CVSS Score
Published: July 27, 2026 at 02:58 PM UTC
Updated: October 24, 2026 at 01:10 PM UTC
2 products affected across 1 vendorErlang /otpErts

Using OTP by Erlang?

Get instant alerts when new vulnerabilities affect OTP - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.5
Exploit prediction
EPSS 0.4%
SSVC
No known exploit

Description

Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon (epmd) via connection slot exhaustion. The do_accept function in erts/epmd/src/epmd_srv.c calls epmd_cleanup_exit() when accept(2) returns EMFILE (per-process file descriptor limit reached) or ENFILE (system-wide file descriptor limit reached), rather than treating these as recoverable conditions. An attacker can exhaust epmd's file descriptor slots by holding many TCP connections open while periodically sending a single byte to reset the idle timeout, then causing accept(2) to return EMFILE, which kills the daemon. epmd has no per-source-IP connection cap, making the attack feasible from a single source. On Debian/Ubuntu default packaging the impact is amplified: the systemd unit inherits a low file descriptor soft limit, and repeated daemon deaths trigger systemd's start-rate-limit, permanently failing both epmd.service and epmd.socket and requiring manual operator intervention to recover. This issue affects OTP from OTP 17.0 before OTP 27.3.4.15, 28.5.0.4, and 29.0.4.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Erlang /otp· Erlang
95%
17.0 ≤ v < 27.3.428.0 ≤ v < 28.5.0.429.0 ≤ v < 29.0.417.06.07b8f441ca711f9812fad9e9115bab3c3aa92f79
Vendor states this is fixed in 865d203e4a6a8f44179eced9e1428f9259e4a3bb (fixed)
Affected range stops below 27.3.4, so it looks safe — our inference, not a vendor statement
Affected range stops below 27.3.4.15, so it looks safe — our inference, not a vendor statement
Affected range stops below 28.5.0.4, so it looks safe — our inference, not a vendor statement
Affected range stops below 29.0.4, so it looks safe — our inference, not a vendor statement
Erts· Erlang
95%
16.0 ≤ v < 16.4.0.417.0 ≤ v < 17.0.46.0 ≤ v < 15.2.7.11
Affected range stops below 15.2.7.11, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.4.0.4, so it looks safe — our inference, not a vendor statement
Affected range stops below 17.0.4, so it looks safe — our inference, not a vendor statement

References (5)

Vendor AdvisoryRelated
Source: cverecord
https://github.com/erlang/otp/security/advisories/GHSA-h6f3-hx58-xhj6
RelatedPatchThird Party Advisory
Source: cverecord
https://cna.erlef.org/cves/CVE-2026-42792.html
RelatedPatchThird Party Advisory
Source: cverecord
https://osv.dev/vulnerability/EEF-CVE-2026-42792
x_version-schemeRelease Notes
Source: cverecord
https://www.erlang.org/doc/system/versions.html#order-of-versions
Patch
Source: cverecord
https://github.com/erlang/otp/commit/865d203e4a6a8f44179eced9e1428f9259e4a3bb

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.5HIGH[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-755CWE-770

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card