Vulnerability · Published Jul 27, 2026 · Assigned by EEF
CVE-2026-42792epmd permanent DoS via EMFILE on accept(2) in erts
Medium 6.3
In plain English
A medium-severity resource allocation without limits in OTP from Erlang. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon (epmd) via connection slot exhaustion. The do_accept function in erts/epmd/src/epmd_srv.c calls epmd_cleanup_exit() when accept(2) returns EMFILE (per-process file descriptor limit reached) or ENFILE (system-wide file descriptor limit reached), rather than treating these as recoverable conditions. An attacker can exhaust epmd's file descriptor slots by holding many TCP connections open while periodically sending a single byte to reset the idle timeout, then causing accept(2) to return EMFILE, which kills the daemon. epmd has no per-source-IP connection cap, making the attack feasible from a single source. On Debian/Ubuntu default packaging the impact is amplified: the systemd unit inherits a low file descriptor soft limit, and repeated daemon deaths trigger systemd's start-rate-limit, permanently failing both epmd.service and epmd.socket and requiring manual operator intervention to recover. This issue affects OTP from OTP 17.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | erlang | no fix listed | DEBIAN-CVE-2026-42792 |
| Debian:13 | erlang | 1:27.3.4.1+dfsg-1+deb13u3 | DEBIAN-CVE-2026-42792 |
| Debian:14 | erlang | 1:29.0.4+dfsg-1 | DEBIAN-CVE-2026-42792 |
| Ubuntu:22.04:LTS | erlang | 1:24.2.1+dfsg-1ubuntu0.7 | USN-8827-1 |
| Ubuntu:22.04:LTS | erlang | 1:24.2.1+dfsg-1ubuntu0.7 | UBUNTU-CVE-2026-42792 |
| Ubuntu:24.04:LTS | erlang | 1:25.3.2.8+dfsg-1ubuntu4.7 | USN-8827-1 |
| Ubuntu:24.04:LTS | erlang | 1:25.3.2.8+dfsg-1ubuntu4.7 | UBUNTU-CVE-2026-42792 |
| Ubuntu:26.04:LTS | erlang | 1:27.3.4.6+dfsg-1ubuntu0.1 | UBUNTU-CVE-2026-42792 |
| Ubuntu:26.04:LTS | erlang | 1:27.3.4.6+dfsg-1ubuntu0.1 | USN-8827-1 |
Affected products (as reported)
Weakness: CWE-755, CWE-770 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
References
- https://github.com/erlang/otp/security/advisories/GHSA-h6f3-hx58-xhj6 vendor-advisory, related
- https://cna.erlef.org/cves/CVE-2026-42792.html related
- https://osv.dev/vulnerability/EEF-CVE-2026-42792 related
- https://www.erlang.org/doc/system/versions.html#order-of-versions x_version-scheme
- https://github.com/erlang/otp/commit/865d203e4a6a8f44179eced9e1428f9259e4a3bb patch