Executive brief
A vulnerability in the Erlang Port Mapper Daemon (epmd) allows a remote attacker to crash the service by exhausting its available connection slots. On certain systems like Debian and Ubuntu, this crash can become permanent, preventing the service from restarting automatically and requiring manual intervention. This disrupts the ability of Erlang-based applications to communicate with each other across a network.
Technical details
The vulnerability exists in the do_accept function within erts/epmd/src/epmd_srv.c. When the accept(2) system call returns EMFILE (process file descriptor limit reached) or ENFILE (system-wide limit reached), the daemon calls epmd_cleanup_exit() and terminates instead of treating the error as a recoverable transient condition. An attacker can exploit this by opening numerous TCP connections and sending periodic single bytes to bypass idle timeouts. On systemd-based distributions like Debian/Ubuntu, repeated crashes trigger start-rate-limiting, resulting in a permanent denial-of-service state for both the service and its socket. Patches are available in versions 27.3.4.15, 28.5.0.4, and 29.0.4.
Affected products
- Erlang OTP (erts) 17.0 to 27.3.4.14, 28.0 to 28.5.0.3, 29.0 to 29.0.3
Timeline
- 2026-07-27: advisory
- 2026-07-27: disclosed