CVE-2026-42792: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-42792 is a denial-of-service vulnerability in Erlang OTP's Erlang Port Mapper Daemon (epmd) caused by improper handling of exceptional conditions during connection acceptance. An unauthenticated remote attacker can permanently terminate epmd by exhausting its file descriptor slots through sustained TCP connections. The vulnerability affects Erlang OTP versions from 17.0 before 29.0.4, 28.5.0.4, and 27.3.4.15, as well as ERTS versions from 6.0 before 17.0.4, 16.4.0.4, and 15.2.7.11. It was published on July 27, 2026, with patches released by August 10, 2026. The CVSS v3.1 base score is 7.5 (High), and the CVSS v4.0 base score is 6.3 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause lies in the do_accept function in erts/epmd/src/epmd_srv.c, which incorrectly calls epmd_cleanup_exit() when accept(2) returns EMFILE (per-process file descriptor limit reached) or ENFILE (system-wide file descriptor limit reached), rather than treating these as recoverable transient errors (CWE-755, CWE-770, CWE-253). An attacker exploits this by opening many TCP connections to epmd's port (default 4369) and periodically sending a single byte per connection to reset the idle timeout, preventing the daemon from closing idle connections. Once the file descriptor limit is reached, the next accept(2) call returns EMFILE, triggering the fatal exit path. The attack is feasible from a single source IP because epmd imposes no per-source-IP connection cap. The fix (commit 865d203) adds EMFILE and ENFILE to the list of recoverable error codes that return EPMD_FALSE instead of calling epmd_cleanup_exit() (GitHub Commit, GitHub Advisory).

Successful exploitation results in permanent termination of the epmd daemon, causing a denial of service for all Erlang node discovery and inter-node communication that depends on epmd. On Debian/Ubuntu systems with default packaging, the impact is significantly amplified: the systemd unit inherits a low file descriptor soft limit, and repeated daemon crashes trigger systemd's start-rate-limit, permanently disabling both epmd.service and epmd.socket and requiring manual operator intervention to restore service. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue affecting Erlang-based distributed systems (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.387%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires no authentication, no user interaction, and can be executed from a single source, but does require the attacker to be able to reach epmd's TCP port (4369) — a condition that is more likely on Debian/Ubuntu systems where epmd listens on all interfaces by default.

1. Reconnaissance: Identify hosts running Erlang OTP with epmd exposed on TCP port 4369 using network scanners (e.g., nmap -p 4369 <target>). Prioritize Debian/Ubuntu systems where epmd may listen on all interfaces by default.
2. Establish many TCP connections: Open a large number of simultaneous TCP connections to port 4369 on the target, approaching or reaching the epmd process's file descriptor limit (which may be as low as 1024 on Debian/Ubuntu default systemd units).
3. Maintain connections with keepalive bytes: Periodically send a single byte on each open connection to reset epmd's idle timeout, preventing the daemon from closing idle connections and freeing file descriptors.
4. Trigger EMFILE condition: Once the file descriptor limit is exhausted, any new incoming connection causes accept(2) to return EMFILE. The vulnerable do_accept function then calls epmd_cleanup_exit(), terminating the daemon.
5. Achieve permanent DoS on Debian/Ubuntu: Repeat the attack if epmd restarts automatically. Repeated crashes trigger systemd's start-rate-limit, permanently failing epmd.service and epmd.socket, requiring manual operator intervention to recover (GitHub Advisory, GitHub Commit).

• Network: Unusually high number of simultaneous TCP connections to port 4369 from one or a small number of source IPs; connections that remain open without completing a full epmd protocol exchange.
• Logs: System logs (/var/log/syslog, journalctl) showing repeated epmd process crashes or exits with file descriptor-related errors; systemd messages indicating epmd.service entering a failed state due to start-rate-limit being exceeded.
• Process: Absence of the epmd process on a system where Erlang nodes are expected to be running; Erlang nodes failing to connect to each other due to epmd unavailability.
• Systemd: systemctl status epmd.service showing failed state with messages like start request repeated too quickly or Too many requests for restart (GitHub Advisory).

Upgrade Erlang OTP to patched versions: 27.3.4.15, 28.5.0.4, or 29.0.4 (or corresponding ERTS versions 15.2.7.11, 16.4.0.4, or 17.0.4). If immediate patching is not possible, apply the following workarounds: (1) Restrict epmd to loopback only by setting ListenStream=127.0.0.1:4369 and ListenStream=[::1]:4369 in a systemd socket override at /etc/systemd/system/epmd.socket.d/override.conf, clearing the default wildcard binding with an empty ListenStream= first. (2) On systemd-managed systems, raise the file descriptor limit by adding LimitNOFILE=65536 and configure automatic restart with Restart=always and a suitable RestartSec in /etc/systemd/system/epmd.service.d/override.conf. (3) Restrict network access to TCP port 4369 via firewall rules to trusted hosts only (GitHub Advisory).

The vulnerability was responsibly disclosed by security researcher Ryan Moore to the Erlang/OTP project and credited in the official GitHub Security Advisory. Red Hat triaged the issue as high severity and opened a tracking bug in their Bugzilla system. No significant broader media coverage or notable community controversy has been observed beyond standard vulnerability tracking and aggregation sites.