CVE-2026-42792

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-42792
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42792.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-42792
Aliases
Downstream
Published
2026-07-27T14:58:24.426Z
Modified
2026-07-29T08:20:27.564080Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
epmd permanent DoS via EMFILE on accept(2) in erts
Details

Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon (epmd) via connection slot exhaustion.

The doaccept function in erts/epmd/src/epmdsrv.c calls epmdcleanupexit() when accept(2) returns EMFILE (per-process file descriptor limit reached) or ENFILE (system-wide file descriptor limit reached), rather than treating these as recoverable conditions. An attacker can exhaust epmd's file descriptor slots by holding many TCP connections open while periodically sending a single byte to reset the idle timeout, then causing accept(2) to return EMFILE, which kills the daemon. epmd has no per-source-IP connection cap, making the attack feasible from a single source.

On Debian/Ubuntu default packaging the impact is amplified: the systemd unit inherits a low file descriptor soft limit, and repeated daemon deaths trigger systemd's start-rate-limit, permanently failing both epmd.service and epmd.socket and requiring manual operator intervention to recover.

This issue affects OTP from OTP 17.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15.

Database specific 
{
    "cna_assigner": "EEF",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42792.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "6.0"
                },
                {
                    "fixed": "*"
                },
                {
                    "introduced": "17.0"
                },
                {
                    "fixed": "*"
                },
                {
                    "introduced": "07b8f441ca711f9812fad9e9115bab3c3aa92f79"
                },
                {
                    "fixed": "865d203e4a6a8f44179eced9e1428f9259e4a3bb"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "fixed": "27.3.4.15"
                },
                {
                    "introduced": "28.0"
                },
                {
                    "fixed": "28.5.0.4"
                },
                {
                    "introduced": "29.0"
                },
                {
                    "fixed": "29.0.4"
                }
            ],
            "source": "CPE_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "17.0"
                }
            ],
            "source": "DESCRIPTION"
        }
    ],
    "cwe_ids": [
        "CWE-755",
        "CWE-770"
    ]
}
References

Affected packages

Git / github.com/erlang/otp

Affected ranges

Type
GIT
Repo
https://github.com/erlang/otp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
865d203e4a6a8f44179eced9e1428f9259e4a3bb
Database specific 
{
    "source": "REFERENCES"
}

Affected versions

OTP-17.*
OTP-17.0
OTP-18.*
OTP-18.0
OTP-18.0-rc1
OTP-19.*
OTP-19.0
OTP-19.0-rc1
OTP-19.0-rc2
OTP-20.*
OTP-20.0
OTP-20.0-rc1
OTP-20.0-rc2
OTP-21.*
OTP-21.0
OTP-21.0-rc1
OTP-21.0-rc2
OTP-22.*
OTP-22.0
OTP-22.0-rc1
OTP-22.0-rc2
OTP-22.0-rc3
OTP-23.*
OTP-23.0
OTP-23.0-rc1
OTP-23.0-rc2
OTP-23.0-rc3
OTP-24.*
OTP-24.0
OTP-24.0-rc1
OTP-24.0-rc2
OTP-24.0-rc3
OTP-25.*
OTP-25.0
OTP-25.0-rc1
OTP-25.0-rc2
OTP-25.0-rc3
OTP-26.*
OTP-26.0
OTP-26.0-rc1
OTP-26.0-rc2
OTP-26.0-rc3
OTP-27.*
OTP-27.0
OTP-27.0-rc1
OTP-27.0-rc2
OTP-27.0-rc3
OTP-27.1
OTP-27.2
OTP-27.3
OTP-27.3.1
OTP-27.3.2
OTP-27.3.3
OTP-27.3.4
OTP_17.*
OTP_17.0-rc1
OTP_17.0-rc2
Other
OTP_R13B03
OTP_R13B04
OTP_R14A
OTP_R14B
OTP_R14B01
OTP_R14B02
OTP_R14B03
OTP_R15A
OTP_R15B
OTP_R16A_RELEASE_CANDIDATE
OTP_R16B
patch-base-27

Database specific

vanir_signatures_modified 
"2026-07-29T08:20:27Z"
vanir_signatures 
[
    {
        "target": {
            "function": "do_read",
            "file": "erts/epmd/src/epmd_srv.c"
        },
        "id": "CVE-2026-42792-3e569608",
        "digest": {
            "function_hash": "310525855057528063101217745630610969602",
            "length": 1917.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/erlang/otp/commit/865d203e4a6a8f44179eced9e1428f9259e4a3bb"
    },
    {
        "target": {
            "function": "do_accept",
            "file": "erts/epmd/src/epmd_srv.c"
        },
        "id": "CVE-2026-42792-606de8b4",
        "digest": {
            "function_hash": "93391892168340247771085395168505802795",
            "length": 409.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/erlang/otp/commit/865d203e4a6a8f44179eced9e1428f9259e4a3bb"
    },
    {
        "target": {
            "file": "erts/epmd/src/epmd_srv.c"
        },
        "id": "CVE-2026-42792-c2d5d3bb",
        "digest": {
            "line_hashes": [
                "238157251032314231486967188355879206108",
                "86184410035617349685376861601664932279",
                "40946427153739319776196253753660958900",
                "61051318659913979963993175574441306207",
                "303349260329761694838462190148736643395",
                "219761322498135725918286544730314218223",
                "146686821301340928619043813619779116451",
                "59933131841513725094244785301980839374",
                "81439414632635711633021290769203132101",
                "294925733372327475393072561666591087259",
                "26485111048758426787724038438679444522",
                "72787819258942913419554890019327627874",
                "190999646518536520587784165358838085546",
                "291588177588217944374030007283233404417",
                "151471799664845060779944634883358307399"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/erlang/otp/commit/865d203e4a6a8f44179eced9e1428f9259e4a3bb"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42792.json"