CVE-2026-42792

The CVSS 6.3 score for this vulnerability fundamentally mischaracterizes the actual risk. The bug itself is simple: epmd_srv.c's do_accept() function treats EMFILE and ENFILE (file descriptor exhaustion) as fatal conditions that crash the daemon rather than recoverable errors. But stopping at the code-level analysis misses the operational severity. The exploitation path is trivial. An attacker opens many connections to epmd, periodically sends a single byte every few minutes to keep them alive past the idle timeout, and eventually exhausts the file descriptor limit. When the daemon exits on EMFILE/ENFILE, systemd's start-rate-limit protection kicks in — and stays engaged. The result is not a transient DoS but a permanent outage requiring manual operator intervention: logging into the system, resetting the systemd rate-limit state, then restarting epmd. This is fundamentally different from a service that crashes and auto-recovers. The lack of per-source-IP connection limiting is not incidental — it's the design choice that makes this trivially exploitable from any single vantage point. No botnet, no distributed infrastructure, no rate-limiting to bypass. Worse, epmd is the Port Mapper Daemon for Erlang clusters. When epmd becomes unreachable, every Erlang node loses its ability to discover peers. Riak clusters stop coordinating. RabbitMQ queues become unreachable. Any distributed Erlang application loses service registration. The blast radius extends far beyond epmd itself into the entire application tier. For defenders: verify your epmd version (the affected range spans OTP 17.0 through current releases), confirm your systemd configuration, and document the procedure to reset the rate-limit state before an incident occurs. The remediation is not simply 'restart the service' — you need a documented recovery path that accounts for systemd's amplification. Consider whether your deployment has per-source connection limits at a higher layer (load balancer, firewall) as a mitigation until the patch is applied.

Reviewed through automated stages and approved by a human before publication.