Network & Host
One Byte Every 30 Seconds: Permanently Killing epmd with CVE-2026-42792
This post walks through CVE-2026-42792, a chain of three small defects in Erlang's epmd (Port Mapper Daemon) that combine into a permanent, unauthenticated remote denial of service. Synack researcher Ryan Moore shows how an attacker sending about 34 bytes per second from a single IP can exhaust epmd's connection slots, trigger an unhandled file-descriptor error that kills the daemon, and exploit systemd's default restart-rate limits to permanently disable it, requiring manual operator recovery.
