CVE-2026-42792
Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an…
Technology
Erlang/OTP
CVSS Score
7.5 / 10.0
Affected Versions
>=17.0 <27.3.4; >=28.0 <28.5.0.4; >=29.0 <29.0.4
Upstream Fix
See upstream advisory
Published
July 27, 2026
OSSeva Coverage
Fixed upstream
Description
Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon (epmd) via connection slot exhaustion. The do_accept function in erts/epmd/src/epmd_srv.c calls epmd_cleanup_exit() when accept(2) returns EMFILE (per-process file descriptor limit reached) or ENFILE (system-wide file descriptor limit reached), rather than treating these as recoverable conditions. An attacker can exhaust epmd's file descriptor slots by holding many TCP connections open while periodically sending a single byte to reset the idle timeout, then causing
Is your Erlang/OTP deployment affected?
If you're running >=17.0 <27.3.4; >=28.0 <28.5.0.4; >=29.0 <29.0.4, you need this patch. Book a discovery call to get covered.
View Erlang/OTP coverage →Get a quote
Running Erlang/OTP >=17.0 <27.3.4; >=28.0 <28.5.0.4; >=29.0 <29.0.4?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?