Read the docs
TI-2026-31012 Aliases CVE-2026-42792

epmd permanent DoS via EMFILE on accept(2) in erts

Priority LOW 28CWE-755Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-770.

Summary

Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon (epmd) via connection slot exhaustion. The do_accept function in erts/epmd/src/epmd_srv.c calls epmd_cleanup_exit() when accept(2) returns EMFILE (per-process file descriptor limit reached) or ENFILE (system-wide file descriptor limit reached), rather than treating these as recoverable conditions. An attacker can exhaust epmd's file descriptor slots by holding many TCP connections open while periodically sending a single byte to reset the idle timeout, then causing accept(2) to return EMFILE, which kills the daemon. epmd has no per-source-IP connection cap, making the attack feasible from a single source. On Debian/Ubuntu default packaging the impact is amplified: the systemd unit inherits a low file descriptor soft limit, and repeated daemon deaths trigger systemd's start-rate-limit, permanently failing both epmd.service and epmd.socket and requiring manual operator intervention to recover. This issue affects OTP from OTP 17.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00435 38th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ErlangOTP6.0 and later—No fix listedCNA
ErlangOTP17.0 and later—Patch availableCNA
  • OTP VendorErlang Affected 6.0 and later Fixed in — No fix listed CNA
  • OTP VendorErlang Affected 17.0 and later Fixed in — Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*17.0 to before 27.3.4; 28.0 to before 28.5.0.4; 29.0 to before 29.0.4VulnerableErlang
cpe:2.3:a:erlang:erts:*:*:*:*:*:*:*:*6.0 to before 15.2.7.11; 16.0 to before 16.4.0.4; 17.0 to before 17.0.4VulnerableErlang
  • cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* Versions 17.0 to before 27.3.4; 28.0 to before 28.5.0.4; 29.0 to before 29.0.4 Vulnerable ·Erlang
  • cpe:2.3:a:erlang:erts:*:*:*:*:*:*:*:* Versions 6.0 to before 15.2.7.11; 16.0 to before 16.4.0.4; 17.0 to before 17.0.4 Vulnerable ·Erlang

Remediation

Red Hat 1 advisory

  • RHSA-2026:47009 Released 2026-07-28 · Red Hat rating Critical
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images erlang27-27.3.4.15-0.1.hum1@aarch64, erlang27-27.3.4.15-0.1.hum1@src, erlang27-27.3.4.15-0.1.hum1@x86_64 +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Hardened ImagesFixed RHSA-2026:47009

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42792

References

Patch 3

Advisory 1

Other 1

  • TI-2025-23504 Erlang/OTP SSH Vulnerable to Pre-Authentication RCE KEVCVSS 3.1CRITICAL 10.0
  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2017-14604 The Erlang otp TLS server answers with different TLS alerts to different error types in… CVSS 3.0MEDIUM 5.9
  • TI-2026-36669 Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash CVSS 4.0HIGH 8.8
  • TI-2022-17230 In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a… CVSS 3.1CRITICAL 9.8
  • TI-2016-08327 An issue was discovered in Erlang/OTP 18.x. CVSS 3.0CRITICAL 9.8
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences