CVE-2026-42792 Erlang CVE debrief

Who should care

Erlang OTP users, especially those using versions before OTP 29.0.4, OTP 28.5.0.4, and OTP 27.3.4.15, should be aware of this vulnerability and take necessary actions to protect their systems. System administrators and security teams responsible for Erlang OTP deployments should prioritize updating to a secure version or implementing mitigations.

Technical summary

The do_accept function in erts/epmd/src/epmd_srv.c calls epmd_cleanup_exit() when accept(2) returns EMFILE (per-process file descriptor limit reached) or ENFILE (system-wide file descriptor limit reached), rather than treating these as recoverable conditions. An attacker can exhaust epmd's file descriptor slots by holding many TCP connections open while periodically sending a single byte to reset the idle timeout, then causing accept(2) to return EMFILE, which kills the daemon. epmd has no per-source-IP connection cap, making the attack feasible from a single source.

Defensive priority

High priority should be given to updating Erlang OTP to a secure version, especially for systems exposed to untrusted networks. Additional defensive measures include monitoring for connection slot exhaustion and implementing rate limiting on incoming connections.

Recommended defensive actions

• Update Erlang OTP to version 29.0.4, 28.5.0.4, or 27.3.4.15, or later
• Implement rate limiting on incoming connections to epmd
• Monitor epmd logs for signs of connection slot exhaustion
• Consider using a firewall or network filtering to limit exposure to untrusted networks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. The Erlang OTP project has released a fix for this issue. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify affected systems and apply patches or mitigations as needed. Additional information may be available from Erlang OTP project resources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.