The vulnerability arises because the epmd daemon's do_accept function treats accept(2) errors EMFILE and ENFILE (file descriptor limits reached) as fatal, calling epmd_cleanup_exit() and terminating the daemon instead of recovering. An attacker can hold many TCP connections open and periodically send a byte to reset idle timers, exhausting epmd's file descriptor slots. Without per-source-IP connection limits, this attack is feasible from a single source. On Debian/Ubuntu, systemd's inherited low file descriptor soft limit and start-rate-limit amplify the impact, causing permanent failure of epmd.service and epmd.socket until manual intervention. Affected Erlang OTP versions include all from 17.0 before OTP 29.0.4, 28.5.0.4, and 27.3.4.15.

An unauthenticated remote attacker can cause a denial of service by permanently terminating the Erlang Port Mapper Daemon (epmd) through connection slot exhaustion. This disrupts the epmd service, which is critical for node discovery in Erlang systems. On systems using systemd with default low file descriptor limits, repeated daemon crashes trigger start-rate-limiting, causing epmd.service and epmd.socket to fail permanently, requiring manual operator intervention to restore service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, operators should consider increasing file descriptor limits for epmd and implementing external connection rate limiting or firewall rules to limit the number of simultaneous connections to epmd. Manual intervention may be required to recover epmd.service and epmd.socket if they have failed due to systemd start-rate-limiting.