CVE-2026-42792: Erlang OTP epmd DoS Vulnerability

CVE-2026-42792 Overview

CVE-2026-42792 is an Improper Handling of Exceptional Conditions vulnerability [CWE-755] in the Erlang Port Mapper Daemon (epmd), a core component of Erlang/OTP's runtime system (erts). An unauthenticated remote attacker can permanently terminate epmd by exhausting its connection slots, causing accept(2) to return EMFILE or ENFILE. The do_accept function in erts/epmd/src/epmd_srv.c treats these conditions as fatal and invokes epmd_cleanup_exit(), killing the daemon. Because epmd enforces no per-source-IP connection cap, the attack succeeds from a single source. The issue affects OTP from 17.0 before 29.0.4, 28.5.0.4, and 27.3.4.15.

Critical Impact
On Debian and Ubuntu default packaging, repeated daemon deaths trip systemd's start-rate-limit, permanently failing both epmd.service and epmd.socket and disrupting Erlang node discovery until an operator intervenes.

Affected Products

Erlang/OTP versions from 17.0 up to but not including 29.0.4
Erlang/OTP 28.5.0.x before 28.5.0.4
Erlang/OTP 27.3.4.x before 27.3.4.15

Discovery Timeline

2026-07-27 - CVE-2026-42792 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-42792

Vulnerability Analysis

The Erlang Port Mapper Daemon brokers node name to TCP port resolution for distributed Erlang clusters. Its accept loop in erts/epmd/src/epmd_srv.c handles inbound connections through the do_accept function. When the process reaches the per-process file descriptor limit (EMFILE) or the system-wide limit (ENFILE), do_accept calls epmd_cleanup_exit() and terminates the daemon. These errno values are recoverable at the kernel level, so treating them as fatal converts a transient resource pressure event into a persistent denial of service. See the Erlang security advisory GHSA-h6f3-hx58-xhj6 for vendor detail.

Root Cause

The root cause is improper exception handling combined with the absence of a per-source-IP connection quota. The daemon assumes that any accept(2) failure other than EINTR indicates an unrecoverable condition. It does not distinguish resource-exhaustion errnos from programming errors, and it does not throttle or evict slow clients. Idle connections extend indefinitely because a single byte written by the peer resets epmd's idle timer.

Attack Vector

An attacker opens TCP connections to epmd (default port 4369) up to the daemon's file descriptor soft limit. Each connection sends one byte periodically to defeat the idle timeout. Once the slot pool is saturated, the next legitimate connection triggers EMFILE inside do_accept, and the daemon exits. On Debian and Ubuntu, the systemd unit inherits a low LimitNOFILE and the restart loop hits systemd's start-rate-limit, disabling epmd.service and epmd.socket until an operator runs systemctl reset-failed.

// Source: https://github.com/erlang/otp/commit/865d203e4a6a8f44179eced9e1428f9259e4a3bb
// Patch excerpt from erts/epmd/src/epmd_srv.c - "epmd: Improve slow-connection handling"
	  return;
	}
    }
-  
-  s->mod_time = current_time(g); /* Note activity */
-  
-  if (s->want == s->got)
+
+    if (s->want == s->got)
    {
-      /* Do action and close up */
-      /* Skip header bytes */
+      /* Note activity. */
+      s->mod_time = current_time(g);

+      /* Do action and close up. +/- 2 is to skip the length prefix. */
      do_request(g, s->fd, s, s->buf + 2, s->got - 2);

-      if (!s->keep)
-	epmd_conn_close(g,s);		/* Normal close */
+      if (!s->keep) {
+        /* Normal close */
+        epmd_conn_close(g,s);
+      }
    }
}

The patch stops treating trickled bytes as activity that resets the idle timer, so slow clients can no longer hold connection slots indefinitely. Review the full change in the upstream commit.

Detection Methods for CVE-2026-42792

Indicators of Compromise

Sudden termination of the epmd process with EMFILE or ENFILE errors in system logs.
epmd.service and epmd.socket in a failed state with systemd reporting start-rate-limit hits.
A high count of established TCP connections to port 4369 originating from one or a few source IPs.
Erlang distribution failures across nodes and net_adm:ping/1 calls returning pang after the daemon dies.

Detection Strategies

Alert on epmd process exits and correlate with accept: Too many open files messages in the daemon log.
Monitor systemd for start-limit-hit events targeting epmd.service or epmd.socket.
Baseline the normal count of concurrent connections to TCP/4369 and flag deviations from a single source IP.

Monitoring Recommendations

Track file descriptor usage of the epmd process with node exporters or lsof -p $(pidof epmd) | wc -l.
Ingest journalctl -u epmd and journalctl -u epmd.socket into your SIEM or log platform.
Add network telemetry rules for a high ratio of half-idle TCP connections to port 4369.

How to Mitigate CVE-2026-42792

Immediate Actions Required

Upgrade Erlang/OTP to 29.0.4, 28.5.0.4, or 27.3.4.15 or later on all nodes running epmd.
Restrict inbound access to TCP/4369 to trusted management and cluster subnets using host or perimeter firewalls.
Raise the LimitNOFILE setting on the epmd.service systemd unit to reduce the ease of slot exhaustion until patched.
Reset failed units after any incident with systemctl reset-failed epmd.service epmd.socket and confirm recovery.

Patch Information

The upstream fix is committed in erlang/otp@865d203 and released in OTP 29.0.4, 28.5.0.4, and 27.3.4.15. See the Erlang CNA advisory and the OSV record for distribution guidance. Version ordering follows the Erlang version documentation.

Workarounds

Bind epmd to a management interface with -address so it does not listen on all interfaces.
Front epmd with a stateful firewall that enforces per-source-IP connection limits and idle timeouts on TCP/4369.
Increase the systemd LimitNOFILE value and relax StartLimitBurst and StartLimitIntervalSec for epmd.service to slow the permanent-failure condition.
Deploy network segmentation so only Erlang cluster members can reach the port mapper.

bash

# Example hardening for /etc/systemd/system/epmd.service.d/override.conf
[Service]
LimitNOFILE=65536

[Unit]
StartLimitIntervalSec=60
StartLimitBurst=10

# Apply firewall restriction (nftables)
# nft add rule inet filter input tcp dport 4369 ip saddr != { 10.0.0.0/24 } drop

# Reload after edits
systemctl daemon-reload
systemctl reset-failed epmd.service epmd.socket
systemctl restart epmd.socket