The vulnerability arises from the Erlang Runtime System’s epmd daemon incorrectly treating an EMFILE or ENFILE condition as a fatal error. When the per‑process file‑descriptor limit is reached, epmd invokes cleanup_exit and stops permanently. An attacker can trigger this by opening many TCP connections to port 4369 and periodically sending a single byte so the connections remain active until the limit is hit, thereby causing a DoS.

Erlang:OTP installations older than OTP 29.0.4, the 28.5.0.4 release, or the 27.3.4.15 run the epmd component on TCP port 4369. Common Linux distributions such as Debian and Ubuntu package epmd with a systemd unit that imposes a low file‑descriptor soft limit, making the exploitation easier and leading to permanent daemon failure when the limit is exceeded.

The CVSS score of 6.3 indicates moderate severity. The EPSS score is < 1%, indicating a very low probability of exploitation. The exploit requires only an unauthenticated network connection and a single source IP. The lack of a per‑source connection cap, combined with systemd’s low file‑descriptor limits and start‑rate‑limit handling, means a successful attack can permanently halt epmd and require manual operator intervention. The vulnerability is not listed in CISA’s KEV catalog, but its simplicity and potential impact warrant prompt attention.