Erlang OTP prior 27.3.4.15/28.5.0.4/29.0.4 Port Mapper erts/epmd/src/epmd_srv.c do_accept exceptional condition

Summaryinfo

A vulnerability was found in Erlang OTP. It has been declared as problematic. The affected element is the function do_accept of the file erts/epmd/src/epmd_srv.c of the component Port Mapper. The manipulation results in exceptional condition. This vulnerability is identified as CVE-2026-42792. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Erlang OTP. Affected is the function do_accept of the file erts/epmd/src/epmd_srv.c of the component Port Mapper. The manipulation with an unknown input leads to a exceptional condition vulnerability. CWE is classifying the issue as CWE-755. The product does not handle or incorrectly handles an exceptional condition. This is going to have an impact on availability. CVE summarizes:

Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon (epmd) via connection slot exhaustion. The do_accept function in erts/epmd/src/epmd_srv.c calls epmd_cleanup_exit() when accept(2) returns EMFILE (per-process file descriptor limit reached) or ENFILE (system-wide file descriptor limit reached), rather than treating these as recoverable conditions. An attacker can exhaust epmd's file descriptor slots by holding many TCP connections open while periodically sending a single byte to reset the idle timeout, then causing accept(2) to return EMFILE, which kills the daemon. epmd has no per-source-IP connection cap, making the attack feasible from a single source. On Debian/Ubuntu default packaging the impact is amplified: the systemd unit inherits a low file descriptor soft limit, and repeated daemon deaths trigger systemd's start-rate-limit, permanently failing both epmd.service and epmd.socket and requiring manual operator intervention to recover. This issue affects OTP from OTP 17.0 before OTP 27.3.4.15, 28.5.0.4, and 29.0.4.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-42792 since 04/29/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit.

Upgrading to version 27.3.4.15, 28.5.0.4 or 29.0.4 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Erlang

Name

• OTP

Website

• Product: https://github.com/erlang/otp/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion