CVE-2026-42792: CWE-755 Improper Handling of Exceptional Conditions in Erlang OTP
Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon (epmd) via connection slot exhaustion. The do_accept function in erts/epmd/src/epmd_srv.c calls epmd_cleanup_exit() when accept(2) returns EMFILE (per-process file descriptor limit reached) or ENFILE (system-wide file descriptor limit reached), rather than treating these as recoverable conditions. An attacker can exhaust epmd's file descriptor slots by holding many TCP connections open while periodically sending a single byte to reset the idle timeout, then causing accept(2) to return EMFILE, which kills the daemon. epmd has no per-source-IP connection cap, making the attack feasible from a single source. On Debian/Ubuntu default packaging the impact is amplified: the systemd unit inherits a low file descriptor soft limit, and repeated daemon deaths trigger systemd's start-rate-limit, permanently failing both epmd.service and epmd.socket and requiring manual operator intervention to recover. This issue affects OTP from OTP 17.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15.
AI Analysis
Technical Summary
This Red Hat security advisory (RHSA-2026:47009) announces an update to Red Hat Hardened Images RPMs, focusing on erlang27 packages. The update includes version 27.3.4.15-0.1.hum1 of multiple erlang27 components for aarch64 and x86_64 architectures. The advisory addresses three CVEs: CVE-2026-42792, CVE-2026-54890, and CVE-2026-59251, which are associated with weaknesses categorized under CWE-253 (Incorrect Check of Function Return Value), CWE-191 (Integer Underflow), and CWE-770 (Allocation of Resources Without Limits or Throttling). The advisory does not provide detailed technical descriptions of the vulnerabilities or their impact. No exploits are known to be active in the wild. The update is classified as a bug fix and enhancement, implying that the issues are resolved in the updated RPMs. The advisory directs users to Red Hat's image repository for applying the update.
Potential Impact
The vulnerabilities addressed involve potential issues with function return value checks, integer underflow, and resource allocation without limits, which could lead to incorrect program behavior or resource exhaustion. However, the advisory does not specify the exact impact on confidentiality, integrity, or availability. No known exploits in the wild have been reported, suggesting limited or no active exploitation at this time.
Mitigation Recommendations
Red Hat has released updated RPM packages (erlang27 version 27.3.4.15-0.1.hum1) that fix the identified vulnerabilities. Users of Red Hat Hardened Images should apply these updates as provided by Red Hat to remediate the issues. Since this is an official Red Hat advisory with an update available, applying the vendor-provided update is the recommended mitigation. No additional or alternative mitigations are indicated in the advisory.
CVE-2026-42792: CWE-755 Improper Handling of Exceptional Conditions in Erlang OTP
Description
Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon (epmd) via connection slot exhaustion. The do_accept function in erts/epmd/src/epmd_srv.c calls epmd_cleanup_exit() when accept(2) returns EMFILE (per-process file descriptor limit reached) or ENFILE (system-wide file descriptor limit reached), rather than treating these as recoverable conditions. An attacker can exhaust epmd's file descriptor slots by holding many TCP connections open while periodically sending a single byte to reset the idle timeout, then causing accept(2) to return EMFILE, which kills the daemon. epmd has no per-source-IP connection cap, making the attack feasible from a single source. On Debian/Ubuntu default packaging the impact is amplified: the systemd unit inherits a low file descriptor soft limit, and repeated daemon deaths trigger systemd's start-rate-limit, permanently failing both epmd.service and epmd.socket and requiring manual operator intervention to recover. This issue affects OTP from OTP 17.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15.
CVSS v4.0
Score 6.3medium
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This Red Hat security advisory (RHSA-2026:47009) announces an update to Red Hat Hardened Images RPMs, focusing on erlang27 packages. The update includes version 27.3.4.15-0.1.hum1 of multiple erlang27 components for aarch64 and x86_64 architectures. The advisory addresses three CVEs: CVE-2026-42792, CVE-2026-54890, and CVE-2026-59251, which are associated with weaknesses categorized under CWE-253 (Incorrect Check of Function Return Value), CWE-191 (Integer Underflow), and CWE-770 (Allocation of Resources Without Limits or Throttling). The advisory does not provide detailed technical descriptions of the vulnerabilities or their impact. No exploits are known to be active in the wild. The update is classified as a bug fix and enhancement, implying that the issues are resolved in the updated RPMs. The advisory directs users to Red Hat's image repository for applying the update.
Potential Impact
The vulnerabilities addressed involve potential issues with function return value checks, integer underflow, and resource allocation without limits, which could lead to incorrect program behavior or resource exhaustion. However, the advisory does not specify the exact impact on confidentiality, integrity, or availability. No known exploits in the wild have been reported, suggesting limited or no active exploitation at this time.
Mitigation Recommendations
Red Hat has released updated RPM packages (erlang27 version 27.3.4.15-0.1.hum1) that fix the identified vulnerabilities. Users of Red Hat Hardened Images should apply these updates as provided by Red Hat to remediate the issues. Since this is an official Red Hat advisory with an update available, applying the vendor-provided update is the recommended mitigation. No additional or alternative mitigations are indicated in the advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:47009
- Cve Count
- 3
- Additional Cves
- ["CVE-2026-54890","CVE-2026-59251"]
- Cvss Version
- null
Threat ID: 6a6ae50c9c2644c7f897f9dc
Added to database: 07/30/2026, 05:45:48 UTC
Last enriched: 07/30/2026, 05:48:36 UTC
Last updated: 07/31/2026, 22:17:51 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.