Patch Package:           OTP 29.1.2
Git Tag:                 OTP-29.1.2
Date:                    2026-10-14
Trouble Report Id:       OTP-20359, OTP-20360, OTP-20385, OTP-20392,
                         OTP-20394, OTP-20408, OTP-20415, OTP-20418,
                         OTP-20420, OTP-20423, OTP-20426, OTP-20427,
                         OTP-20428, OTP-20437, OTP-20438, OTP-20439,
                         OTP-20440, OTP-20442, OTP-20444, OTP-20445,
                         OTP-20447, OTP-20456
Seq num:                 CVE-2026-105236, CVE-2026-42789,
                         CVE-2026-48856, CVE-2026-94200,
                         CVE-2026-96596, ERIERL-1362, ERIERL-1367,
                         GH-11620, GH-11691, GH-11702, GH-11709,
                         GH-11724, GH-11735, GH-11748, GH-11762,
                         GH-SA-m75x-4vwg-ggjh, GH-SA-q7cq-pfgf-5hr7,
                         OTP-20155, OTP-20346, PR-11474, PR-11561,
                         PR-11623, PR-11662, PR-11692, PR-11707,
                         PR-11708, PR-11719, PR-11720, PR-11727,
                         PR-11753, PR-11755, PR-11763, PR-11767,
                         PR-11768, PR-11773, PR-11791, PR-11808,
                         PR-11823, PR-11824, PR-11825
System:                  OTP
Release:                 29
Application:             compiler-10.0.7, dialyzer-6.0.4, erts-17.1.1,
                         inets-9.8.1, mnesia-4.27.1, odbc-2.17.2,
                         public_key-1.21.8, snmp-5.20.6, ssh-6.0.7,
                         ssl-11.7.8, stdlib-8.1.1
Predecessor:             OTP 29.1.1

Check out the git tag OTP-29.1.2, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.

POTENTIAL INCOMPATIBILITIES

• When the max_channels limit is reached for a port-forwarding channel (direct-tcpip or forwarded-tcpip), the SSH daemon now refuses the individual channel with SSH_MSG_CHANNEL_OPEN_FAILURE and keeps the connection alive, instead of terminating the whole SSH connection. Port-forwarding channels now behave like session channels, which already survived the limit, and this matches OpenSSH. Applications that relied on the connection being closed when the channel limit was reached must instead handle the channel-open failure.

  Own Id: OTP-20420
  Application(s): ssh
  Related Id(s): [PR-11708]

compiler-10.0.7

The compiler-10.0.7 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

• Fix native record bugs when used together with try...catch

  Own Id: OTP-20415
  Related Id(s): [GH-11691], [PR-11719]

• Compilation of a function with thousands of clauses would be very slow.

  Own Id: OTP-20437
  Related Id(s): [GH-11735], [PR-11767]

• Sometimes compiling with deterministic would not guarantee generation of identical BEAM files for every build.

  Own Id: OTP-20438
  Related Id(s): [GH-11748], [PR-11753]

• A crash in sys_core_fold on native record patterns has been eliminated.

  Own Id: OTP-20440
  Related Id(s): [GH-11724], [PR-11768]

Full runtime dependencies of compiler-10.0.7

crypto-5.1, erts-13.0, kernel-8.4, stdlib-8.0

dialyzer-6.0.4

The dialyzer-6.0.4 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

• Dialyzer will now avoid an infinite loop when multiple nominal types with the same structure are analyzed together.

  Own Id: OTP-20444
  Related Id(s): [GH-11762], [PR-11763]

Full runtime dependencies of dialyzer-6.0.4

compiler-10.0, erts-12.0, kernel-8.0, stdlib-5.0, syntax_tools-2.0

erts-17.1.1

The erts-17.1.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

• Two trace sessions that trace garbage_collection on the same process crash the emulator on the first collection.

  trace_gc() in erl_trace.c builds the GC info list on a temporary heap for the first session and frees it inside the session loop. The next session reuses msg, which now points into freed memory.

  The memory is now freed after the session loop, which removes the use-after-free.

  Own Id: OTP-20385
  Related Id(s): [PR-11623]

• Fix native record bugs when used together with try...catch

  Own Id: OTP-20415
  Related Id(s): [GH-11691], [PR-11719]

Full runtime dependencies of erts-17.1.1

kernel-9.0, sasl-3.3, stdlib-4.1

inets-9.8.1

The inets-9.8.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

• Credentials supplied in the userinfo component of a request URI (http://user:password@host/path) were still sent to the redirect target when httpc followed a cross-origin redirect. The userinfo component is now cleared together with the sensitive headers whenever the redirect target differs in host or port from the original request. Redirects that stay within the same origin are unaffected and still carry the credentials.

  Own Id: OTP-20456
  Related Id(s): [GH-SA-m75x-4vwg-ggjh], [PR-11825], [CVE-2026-48856], OTP-20155

Full runtime dependencies of inets-9.8.1

erts-14.0, kernel-9.0, mnesia-4.12, public_key-1.13, runtime_tools-1.8.14, ssl-9.0, stdlib-5.0, stdlib-6.0

mnesia-4.27.1

The mnesia-4.27.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

• Fixed the type specification for mnesia:restore/2, which incorrectly listed the operation restore_tables instead of recreate_tables, causing Dialyzer to reject valid calls and accept invalid ones.

  Own Id: OTP-20442
  Related Id(s): [PR-11755]

Full runtime dependencies of mnesia-4.27.1

erts-9.0, kernel-5.3, stdlib-5.0

odbc-2.17.2

The odbc-2.17.2 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

• Fix error handling to avoid possible memory issues that could cause odbc port program to fail.

  Own Id: OTP-20439
  Related Id(s): [PR-11808]

Full runtime dependencies of odbc-2.17.2

erts-6.0, kernel-3.0, stdlib-2.0

public_key-1.21.8

The public_key-1.21.8 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

• Enforce the RFC 5280 basic-constraints CA checks for X.509 version 1 and version 2 certificates during certificate path validation. A v1/v2 certificate carries no extensions and therefore no basicConstraints, so it must never be accepted as a CA; such a certificate is now rejected in issuer position with {bad_cert, missing_basic_constraint} while remaining valid as a leaf. This closes the version-1 path left uncovered by the earlier CVE-2026-42789 fix.

  Own Id: OTP-20423
  Related Id(s): [PR-11727], [CVE-2026-42789]

Full runtime dependencies of public_key-1.21.8

asn1-5.0, crypto-5.8, erts-13.0, kernel-8.0, stdlib-4.0

snmp-5.20.6

The snmp-5.20.6 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

• The SNMP agent no longer fails to answer an SNMPv3 message whose msgUserName matches the configured terminating-discovery trigger_username (by default the empty string) and whose msgAuthoritativeEngineID is the agent's own engine ID. Such a message is not a stage-1 discovery request, but the agent treated it as one and then failed while generating the report, logging a configuration error and discarding the request without responding. The agent now answers it with a usmStatsUnknownUserNames report, as prescribed by RFC 3414, section 3.2. As a consequence of the same change, a message carrying the trigger user name together with an unknown, non-empty engine ID is now answered with a usmStatsUnknownEngineIDs report instead of being silently discarded.

  Own Id: OTP-20427
  Related Id(s): ERIERL-1362, [PR-11823]

• The byte-length bounds added in OTP-20346 for varbind values now apply to every integer field decoded by snmp_pdus: the v3 header fields msgID, msgMaxSize and msgSecurityModel, the USM security parameters msgAuthoritativeEngineBoots and msgAuthoritativeEngineTime, and the PDU fields request-id, error-status, error-index, non-repeaters, max-repetitions, generic-trap and specific-trap. Each field accepts at most the number of BER content octets that its type requires, instead of an arbitrary number of octets that were converted into a large integer. An over-long integer is now signalled with an exit rather than a throw. Code that calls the exported snmp_pdus decode functions inside a catch will receive {'EXIT', Reason} where it previously received the thrown term directly. Inside the agent and manager, such a message is now discarded and counted in snmpInASNParseErrs; previously it caused a case_clause failure during message processing.

  Own Id: OTP-20428
  Related Id(s): [GH-SA-q7cq-pfgf-5hr7], [PR-11824], OTP-20346

Full runtime dependencies of snmp-5.20.6

asn1-5.4, crypto-4.6, erts-12.0, kernel-8.0, mnesia-4.12, runtime_tools-1.8.14, stdlib-5.0

ssh-6.0.7

The ssh-6.0.7 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

• Fixed a bug where SSH CLI sessions using {shell, {shell, start, []}} did not handle latin1-encoded put_chars messages from the Erlang shell. This caused exception output (e.g. "** exception error: ...") to not be displayed o...

Patch Package:           OTP 28.5.0.8
Git Tag:                 OTP-28.5.0.8
Date:                    2026-10-14
Trouble Report Id:       OTP-20359, OTP-20360, OTP-20385, OTP-20392,
                         OTP-20394, OTP-20408, OTP-20418, OTP-20420,
                         OTP-20423, OTP-20426, OTP-20427, OTP-20428,
                         OTP-20437, OTP-20438, OTP-20439, OTP-20442,
                         OTP-20444, OTP-20445, OTP-20456
Seq num:                 CVE-2026-105236, CVE-2026-42789,
                         CVE-2026-48856, CVE-2026-94200, ERIERL-1362,
                         ERIERL-1367, GH-11620, GH-11702, GH-11709,
                         GH-11735, GH-11748, GH-11762,
                         GH-SA-m75x-4vwg-ggjh, GH-SA-q7cq-pfgf-5hr7,
                         OTP-20155, OTP-20346, PR-11474, PR-11561,
                         PR-11623, PR-11662, PR-11692, PR-11707,
                         PR-11708, PR-11720, PR-11727, PR-11753,
                         PR-11755, PR-11763, PR-11767, PR-11773,
                         PR-11808, PR-11823, PR-11824, PR-11825
System:                  OTP
Release:                 28
Application:             compiler-9.0.6.4, dialyzer-5.4.0.2,
                         erts-16.4.0.7, inets-9.6.2.4,
                         mnesia-4.25.3.4, odbc-2.16.1.1,
                         public_key-1.20.3.6, snmp-5.20.2.3,
                         ssh-5.5.2.7, ssl-11.6.0.7
Predecessor:             OTP 28.5.0.7

Check out the git tag OTP-28.5.0.8, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.

POTENTIAL INCOMPATIBILITIES

• When the max_channels limit is reached for a port-forwarding channel (direct-tcpip or forwarded-tcpip), the SSH daemon now refuses the individual channel with SSH_MSG_CHANNEL_OPEN_FAILURE and keeps the connection alive, instead of terminating the whole SSH connection. Port-forwarding channels now behave like session channels, which already survived the limit, and this matches OpenSSH. Applications that relied on the connection being closed when the channel limit was reached must instead handle the channel-open failure.

  Own Id: OTP-20420
  Application(s): ssh
  Related Id(s): [PR-11708]

compiler-9.0.6.4

The compiler-9.0.6.4 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

• Compilation of a function with thousands of clauses would be very slow.

  Own Id: OTP-20437
  Related Id(s): [GH-11735], [PR-11767]

• Sometimes compiling with deterministic would not guarantee generation of identical BEAM files for every build.

  Own Id: OTP-20438
  Related Id(s): [GH-11748], [PR-11753]

Full runtime dependencies of compiler-9.0.6.4

crypto-5.1, erts-13.0, kernel-8.4, stdlib-6.0

dialyzer-5.4.0.2

The dialyzer-5.4.0.2 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

• Dialyzer will now avoid an infinite loop when multiple nominal types with the same structure are analyzed together.

  Own Id: OTP-20444
  Related Id(s): [GH-11762], [PR-11763]

Full runtime dependencies of dialyzer-5.4.0.2

compiler-8.0, erts-12.0, kernel-8.0, stdlib-5.0, syntax_tools-2.0

erts-16.4.0.7

The erts-16.4.0.7 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

• Two trace sessions that trace garbage_collection on the same process crash the emulator on the first collection.

  trace_gc() in erl_trace.c builds the GC info list on a temporary heap for the first session and frees it inside the session loop. The next session reuses msg, which now points into freed memory.

  The memory is now freed after the session loop, which removes the use-after-free.

  Own Id: OTP-20385
  Related Id(s): [PR-11623]

Full runtime dependencies of erts-16.4.0.7

kernel-9.0, sasl-3.3, stdlib-4.1

inets-9.6.2.4

The inets-9.6.2.4 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

• Credentials supplied in the userinfo component of a request URI (http://user:password@host/path) were still sent to the redirect target when httpc followed a cross-origin redirect. The userinfo component is now cleared together with the sensitive headers whenever the redirect target differs in host or port from the original request. Redirects that stay within the same origin are unaffected and still carry the credentials.

  Own Id: OTP-20456
  Related Id(s): [GH-SA-m75x-4vwg-ggjh], [PR-11825], [CVE-2026-48856], OTP-20155

Full runtime dependencies of inets-9.6.2.4

erts-14.0, kernel-9.0, mnesia-4.12, public_key-1.13, runtime_tools-1.8.14, ssl-9.0, stdlib-5.0, stdlib-6.0

mnesia-4.25.3.4

The mnesia-4.25.3.4 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

• Fixed the type specification for mnesia:restore/2, which incorrectly listed the operation restore_tables instead of recreate_tables, causing Dialyzer to reject valid calls and accept invalid ones.

  Own Id: OTP-20442
  Related Id(s): [PR-11755]

Full runtime dependencies of mnesia-4.25.3.4

erts-9.0, kernel-5.3, stdlib-5.0

odbc-2.16.1.1

The odbc-2.16.1.1 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

• Fix error handling to avoid possible memory issues that could cause odbc port program to fail.

  Own Id: OTP-20439
  Related Id(s): [PR-11808]

Full runtime dependencies of odbc-2.16.1.1

erts-6.0, kernel-3.0, stdlib-2.0

public_key-1.20.3.6

Note! The public_key-1.20.3.6 application cannot be applied independently of other applications on an arbitrary OTP 28 installation.

   On a full OTP 28 installation, also the following runtime
   dependency has to be satisfied:
   -- crypto-5.8 (first satisfied in OTP 28.3)

Fixed Bugs and Malfunctions

• Enforce the RFC 5280 basic-constraints CA checks for X.509 version 1 and version 2 certificates during certificate path validation. A v1/v2 certificate carries no extensions and therefore no basicConstraints, so it must never be accepted as a CA; such a certificate is now rejected in issuer position with {bad_cert, missing_basic_constraint} while remaining valid as a leaf. This closes the version-1 path left uncovered by the earlier CVE-2026-42789 fix.

  Own Id: OTP-20423
  Related Id(s): [PR-11727], [CVE-2026-42789]

Full runtime dependencies of public_key-1.20.3.6

asn1-5.0, crypto-5.8, erts-13.0, kernel-8.0, stdlib-4.0

snmp-5.20.2.3

The snmp-5.20.2.3 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

• The SNMP agent no longer fails to answer an SNMPv3 message whose msgUserName matches the configured terminating-discovery trigger_username (by default the empty string) and whose msgAuthoritativeEngineID is the agent's own engine ID. Such a message is not a stage-1 discovery request, but the agent treated it as one and then failed while generating the report, logging a configuration error and discarding the request without responding. The agent now answers it with a usmStatsUnknownUserNames report, as prescribed by RFC 3414, section 3.2. As a consequence of the same change, a message carrying the trigger user name together with an unknown, non-empty engine ID is now answered with a usmStatsUnknownEngineIDs report instead of being silently discarded.

  Own Id: OTP-20427
  Related Id(s): ERIERL-1362, [PR-11823]

• The byte-length bounds added in OTP-20346 for varbind values now apply to every integer field decoded by snmp_pdus: the v3 header fields msgID, msgMaxSize and msgSecurityModel, the USM security parameters msgAuthoritativeEngineBoots and msgAuthoritativeEngineTime, and the PDU fields request-id, error-status, error-index, non-repeaters, max-repetitions, generic-trap and specific-trap. Each field accepts at most the number of BER content octets that its type requires, instead of an arbitrary number of octets that were converted into a large integer. An over-long integer is now signalled with an exit rather than a throw. Code that calls the exported snmp_pdus decode functions inside a catch will receive {'EXIT', Reason} where it previously received the thrown term directly. Inside the agent and manager, such a message is now discarded and counted in snmpInASNParseErrs; previously it caused a case_clause failure during message processing.

  Own Id: OTP-20428
  Related Id(s): [GH-SA-q7cq-pfgf-5hr7], [PR-11824], OTP-20346

Full runtime dependencies of snmp-5.20.2.3

asn1-5.4, crypto-4.6, erts-12.0, kernel-8.0, mnesia-4.12, runtime_tools-1.8.14, stdlib-5.0

ssh-5.5.2.7

Note! The ssh-5.5.2.7 application cannot be applied independently of other applications on an arbitrary OTP 28 installation.

   On a full OTP 28 installation, also the following runtime
   dependency has to be satisfied:
   -- crypto-5.7 (first satisfied in OTP 28.1)

Fixed Bugs and Malfunctions

• Fixed a bug where SSH CLI sessions using {shell, {shell, start, []}} did not handle latin1-encoded put_chars messages from the Erlang shell. This caused exception output (e.g. "** exception error: ...") to not be displayed on the SSH client, and {unhandled_request, ...} messages to appear on the daemon host.

  Own Id: OTP-20359
  Related Id(s): [PR-11474]

• Fixed the following bugs in the SSH application:

  • The SFTP client (ssh_sftp) checked the channel state record against 0 instead of the exit status integer when handling an exit_status message. T...

Patch Package:           OTP 29.1.1
Git Tag:                 OTP-29.1.1
Date:                    2026-09-22
Trouble Report Id:       OTP-20272, OTP-20287, OTP-20355, OTP-20371,
                         OTP-20386, OTP-20388, OTP-20390, OTP-20393
Seq num:                 CVE-2026-65634, CVE-2026-68956,
                         CVE-2026-89422, ERIERL-1355, ERIERL-1363,
                         GH-11586, GH-11619, GH-SA-qhcm-px9c-rvfh,
                         PR-11523, PR-11559, PR-11616, PR-11630,
                         PR-11638, PR-11641, PR-11651, PR-11655
System:                  OTP
Release:                 29
Application:             asn1-5.5.2, compiler-10.0.6,
                         public_key-1.21.7, ssh-6.0.6, ssl-11.7.7
Predecessor:             OTP 29.1

Check out the git tag OTP-29.1.1, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.

POTENTIAL INCOMPATIBILITIES

• Fixed a vulnerability where the max_channels daemon option was not enforced for session channels without an active subsystem, allowing a remote authenticated user to open an infinite number of channels and exhaust server resources despite the configured limit.

  The default value of the max_channels daemon option has been changed from infinity to 256. Deployments requiring more than 256 simultaneous channels per connection can restore the previous behavior by setting {max_channels, infinity}.

  The default value of the max_sessions daemon option has been changed from infinity to 1024. Deployments requiring more concurrent SSH connections can restore the previous behavior by setting {max_sessions, infinity}.

  Own Id: OTP-20287
  Application(s): ssh
  Related Id(s): GH-SA-qhcm-px9c-rvfh, PR-11523, CVE-2026-68956

asn1-5.5.2

The asn1-5.5.2 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

• Fixed a denial-of-service attack in asn1, where abnormally large OID components (arcs) could cause resource exhaustion.

  Own Id: OTP-20272
  Related Id(s): PR-11655, CVE-2026-65634

• The JER backend will no longer break certain values (true, false, null) when they are typed as ENUMERATED, they will now be encoded as strings as required by the standard.

  Own Id: OTP-20355
  Related Id(s): ERIERL-1355, PR-11559

Full runtime dependencies of asn1-5.5.2

erts-14.0, kernel-9.0, stdlib-5.0

compiler-10.0.6

The compiler-10.0.6 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

• Certain uses of funs could crash the compiler. For example:

  f() ->
      F = fun Fn(0) -> 0; Fn(N) -> Fn(N - 1) end,
      [F(X) || X <- [1, 2]].
  

  This has been corrected.

  Own Id: OTP-20386
  Related Id(s): GH-11619, PR-11638

Full runtime dependencies of compiler-10.0.6

crypto-5.1, erts-13.0, kernel-8.4, stdlib-8.0

public_key-1.21.7

The public_key-1.21.7 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

• Handle that policy qualifiers are optional.

  Own Id: OTP-20393
  Related Id(s): PR-11630

Full runtime dependencies of public_key-1.21.7

asn1-5.0, crypto-5.8, erts-13.0, kernel-8.0, stdlib-4.0

ssh-6.0.6

The ssh-6.0.6 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

• Fixed a vulnerability where the max_channels daemon option was not enforced for session channels without an active subsystem, allowing a remote authenticated user to open an infinite number of channels and exhaust server resources despite the configured limit.

  The default value of the max_channels daemon option has been changed from infinity to 256. Deployments requiring more than 256 simultaneous channels per connection can restore the previous behavior by setting {max_channels, infinity}.

  The default value of the max_sessions daemon option has been changed from infinity to 1024. Deployments requiring more concurrent SSH connections can restore the previous behavior by setting {max_sessions, infinity}.

  Own Id: OTP-20287
  Related Id(s): GH-SA-qhcm-px9c-rvfh, PR-11523, CVE-2026-68956

  *** POTENTIAL INCOMPATIBILITY ***

• The SSH daemon no longer rejects a subsystem request that is preceded by env or pty-req request on the same channel.

  Own Id: OTP-20371
  Related Id(s): ERIERL-1363, GH-11586, PR-11616

Full runtime dependencies of ssh-6.0.6

crypto-5.7, erts-14.0, kernel-10.3, public_key-1.6.1, runtime_tools-1.15.1, stdlib-8.0

ssl-11.7.7

Note! The ssl-11.7.7 application cannot be applied independently of other applications on an arbitrary OTP 29 installation.

   On a full OTP 29 installation, also the following runtime
   dependency has to be satisfied:
   -- public_key-1.21.1 (first satisfied in OTP 29.0.1)

Fixed Bugs and Malfunctions

• Reject unsolicited TLS-1.3 pre_shared_key in client.

  Own Id: OTP-20388
  Related Id(s): PR-11641, CVE-2026-89422

• Security and robustness hardening returning RFC mandated alert reasons, narrowing/correcting length checks.

  Correct signature algorithm handling that slightly mixed up signature algorithms and signature algorithms cert in TLS-1.2.

  Add missing TLS-1.3 Brainpool groups support. (Not relevant in 27 patch)

  Enhanced/corrected documentation and spec errors/deviations.

  Own Id: OTP-20390
  Related Id(s): PR-11651

Full runtime dependencies of ssl-11.7.7

crypto-5.8, erts-16.0, inets-5.10.7, kernel-10.3, public_key-1.21.1, runtime_tools-1.15.1, stdlib-7.0

Thanks to

Alan Duffield

Patch Package:           OTP 28.5.0.7
Git Tag:                 OTP-28.5.0.7
Date:                    2026-09-22
Trouble Report Id:       OTP-20118, OTP-20256, OTP-20272, OTP-20287,
                         OTP-20327, OTP-20355, OTP-20358, OTP-20365,
                         OTP-20371, OTP-20386, OTP-20388, OTP-20390,
                         OTP-20393
Seq num:                 CVE-2026-65634, CVE-2026-68956,
                         CVE-2026-89422, ERIERL-1355, ERIERL-1356,
                         ERIERL-1361, ERIERL-1363, GH-11338, GH-11344,
                         GH-11534, GH-11586, GH-11619,
                         GH-SA-qhcm-px9c-rvfh, PR-11167, PR-11356,
                         PR-11426, PR-11523, PR-11559, PR-11566,
                         PR-11570, PR-11616, PR-11630, PR-11638,
                         PR-11641, PR-11651, PR-11655
System:                  OTP
Release:                 28
Application:             asn1-5.4.3.1, compiler-9.0.6.3,
                         mnesia-4.25.3.3, public_key-1.20.3.5,
                         ssh-5.5.2.6, ssl-11.6.0.6, stdlib-7.3.0.3
Predecessor:             OTP 28.5.0.6

Check out the git tag OTP-28.5.0.7, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.

POTENTIAL INCOMPATIBILITIES

• When beam_lib returns an error tuple, the filename in the information tuple is now a list of characters instead of an atom.

  Example:

  1> beam_lib:chunks(code:which(lists), ["nope"]).
  {error,beam_lib,
         {missing_chunk,".../git/otp/lib/stdlib/ebin/lists.beam",
                        "nope"}}
  

  The reason for this change is that a long file name is not guaranteed to fit in an atom. Applications or tools that do deep inspection of the beam_lib errors (not recommended) will need to be updated.

  Own Id: OTP-20118
  Application(s): stdlib
  Related Id(s): ERIERL-1361, [PR-11167]

• Fixed a vulnerability where the max_channels daemon option was not enforced for session channels without an active subsystem, allowing a remote authenticated user to open an infinite number of channels and exhaust server resources despite the configured limit.

  The default value of the max_channels daemon option has been changed from infinity to 256. Deployments requiring more than 256 simultaneous channels per connection can restore the previous behavior by setting {max_channels, infinity}.

  The default value of the max_sessions daemon option has been changed from infinity to 1024. Deployments requiring more concurrent SSH connections can restore the previous behavior by setting {max_sessions, infinity}.

  Own Id: OTP-20287
  Application(s): ssh
  Related Id(s): [GH-SA-qhcm-px9c-rvfh], [PR-11523], [CVE-2026-68956]

asn1-5.4.3.1

The asn1-5.4.3.1 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

• Fixed a denial-of-service attack in asn1, where abnormally large OID components (arcs) could cause resource exhaustion.

  Own Id: OTP-20272
  Related Id(s): [PR-11655], CVE-2026-65634

• The JER backend will no longer break certain values (true, false, null) when they are typed as ENUMERATED, they will now be encoded as strings as required by the standard.

  Own Id: OTP-20355
  Related Id(s): ERIERL-1355, [PR-11559]

Full runtime dependencies of asn1-5.4.3.1

erts-14.0, kernel-9.0, stdlib-5.0

compiler-9.0.6.3

The compiler-9.0.6.3 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

• In rare circumstances, the type analysis pass of the compiler could run for many minutes.

  Own Id: OTP-20365
  Related Id(s): [GH-11534], [PR-11566]

• Certain uses of funs could crash the compiler. For example:

  f() ->
      F = fun Fn(0) -> 0; Fn(N) -> Fn(N - 1) end,
      [F(X) || X <- [1, 2]].
  

  This has been corrected.

  Own Id: OTP-20386
  Related Id(s): [GH-11619], [PR-11638]

Full runtime dependencies of compiler-9.0.6.3

crypto-5.1, erts-13.0, kernel-8.4, stdlib-6.0

mnesia-4.25.3.3

The mnesia-4.25.3.3 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

• Fixed mnesia:force_load_table/1 getting stuck when the remote node becomes unreachable during table loading. When a network loader is aborted due to sender node going down and a user has forced a table load, we now retry loading from disc instead. Additionally, for disc_only_copies tables, the process actually loading the table is the dets server process, not the mnesia loader, so it would not receive the abort notification and would hang indefinitely. Now it correctly receives the notification and aborts table loading.

  Own Id: OTP-20256
  Related Id(s): [GH-11344], [PR-11426]

Full runtime dependencies of mnesia-4.25.3.3

erts-9.0, kernel-5.3, stdlib-5.0

public_key-1.20.3.5

Note! The public_key-1.20.3.5 application cannot be applied independently of other applications on an arbitrary OTP 28 installation.

   On a full OTP 28 installation, also the following runtime
   dependency has to be satisfied:
   -- crypto-5.8 (first satisfied in OTP 28.3)

Fixed Bugs and Malfunctions

• Handle that policy qualifiers are optional.

  Own Id: OTP-20393
  Related Id(s): [PR-11630]

Full runtime dependencies of public_key-1.20.3.5

asn1-5.0, crypto-5.8, erts-13.0, kernel-8.0, stdlib-4.0

ssh-5.5.2.6

Note! The ssh-5.5.2.6 application cannot be applied independently of other applications on an arbitrary OTP 28 installation.

   On a full OTP 28 installation, also the following runtime
   dependency has to be satisfied:
   -- crypto-5.7 (first satisfied in OTP 28.1)

Fixed Bugs and Malfunctions

• Fixed a vulnerability where the max_channels daemon option was not enforced for session channels without an active subsystem, allowing a remote authenticated user to open an infinite number of channels and exhaust server resources despite the configured limit.

  The default value of the max_channels daemon option has been changed from infinity to 256. Deployments requiring more than 256 simultaneous channels per connection can restore the previous behavior by setting {max_channels, infinity}.

  The default value of the max_sessions daemon option has been changed from infinity to 1024. Deployments requiring more concurrent SSH connections can restore the previous behavior by setting {max_sessions, infinity}.

  Own Id: OTP-20287
  Related Id(s): [GH-SA-qhcm-px9c-rvfh], [PR-11523], [CVE-2026-68956]

  *** POTENTIAL INCOMPATIBILITY ***

• The SSH daemon no longer rejects a subsystem request that is preceded by env or pty-req request on the same channel.

  Own Id: OTP-20371
  Related Id(s): ERIERL-1363, [GH-11586], [PR-11616]

Full runtime dependencies of ssh-5.5.2.6

crypto-5.7, erts-14.0, kernel-10.3, public_key-1.6.1, runtime_tools-1.15.1, stdlib-5.0, stdlib-6.0

ssl-11.6.0.6

Note! The ssl-11.6.0.6 application cannot be applied independently of other applications on an arbitrary OTP 28 installation.

   On a full OTP 28 installation, also the following runtime
   dependencies have to be satisfied:
   -- crypto-5.8 (first satisfied in OTP 28.3)
   -- public_key-1.20.3.1 (first satisfied in OTP 28.5.0.1)

Fixed Bugs and Malfunctions

• Undecodable certificate_authorities names are now skipped, as they are just a hint.

  Own Id: OTP-20327
  Related Id(s): [GH-11338], [PR-11356]

• Corrected generated keylog information generated from the keylog_hs option in the corner case that it was invoked after the client had reached its connection state, but the server closed the connection before it reached its connection state.

  Own Id: OTP-20358
  Related Id(s): ERIERL-1356, [PR-11570]

• Reject unsolicited TLS-1.3 pre_shared_key in client.

  Own Id: OTP-20388
  Related Id(s): [PR-11641], [CVE-2026-89422]

• Security and robustness hardening returning RFC mandated alert reasons, narrowing/correcting length checks.

  Correct signature algorithm handling that slightly mixed up signature algorithms and signature algorithms cert in TLS-1.2.

  Add missing TLS-1.3 Brainpool groups support. (Not relevant in 27 patch)

  Enhanced/corrected documentation and spec errors/deviations.

  Own Id: OTP-20390
  Related Id(s): [PR-11651]

Full runtime dependencies of ssl-11.6.0.6

crypto-5.8, erts-16.0, inets-5.10.7, kernel-10.3, public_key-1.20.3.1, runtime_tools-1.15.1, stdlib-7.0

stdlib-7.3.0.3

Note! The stdlib-7.3.0.3 application cannot be applied independently of other applications on an arbitrary OTP 28 installation.

   On a full OTP 28 installation, also the following runtime
   dependency has to be satisfied:
   -- erts-16.0.3 (first satisfied in OTP 28.0.3)

Fixed Bugs and Malfunctions

• When beam_lib returns an error tuple, the filename in the information tuple is now a list of characters instead of an atom.

  Example:

  1> beam_lib:chunks(code:which(lists), ["nope"]).
  {error,beam_lib,
         {missing_chunk,".../git/otp/lib/stdlib/ebin/lists.beam",
                        "nope"}}
  

  The reason for this change is that a long file name is not guaranteed to fit in an atom. Applications or tools that do deep inspection of the beam_lib errors (not recommended) will need to be updated.

  Own Id: OTP-20118
  Related Id(s): ERIERL-1361, [PR-11167]

  *** POTENTIAL INCOMPATIBILITY ***

Full runtime dependencies of stdlib-7.3.0.3

compiler-5.0, crypto-4.5, erts-16.0.3, kernel-10.0, sasl-3.0, syntax_tools-3.2.1

Thanks to

Alan Duffield, ausimian

Patch Package:           OTP 29.1
Git Tag:                 OTP-29.1
Date:                    2026-09-16
Trouble Report Id:       OTP-19631, OTP-20118, OTP-20131, OTP-20145,
                         OTP-20152, OTP-20158, OTP-20169, OTP-20175,
                         OTP-20177, OTP-20180, OTP-20187, OTP-20188,
                         OTP-20189, OTP-20209, OTP-20211, OTP-20213,
                         OTP-20218, OTP-20228, OTP-20235, OTP-20236,
                         OTP-20238, OTP-20246, OTP-20249, OTP-20254,
                         OTP-20255, OTP-20256, OTP-20262, OTP-20265,
                         OTP-20267, OTP-20276, OTP-20277, OTP-20280,
                         OTP-20290, OTP-20291, OTP-20292, OTP-20293,
                         OTP-20295, OTP-20297, OTP-20298, OTP-20303,
                         OTP-20304, OTP-20305, OTP-20309, OTP-20316,
                         OTP-20317, OTP-20318, OTP-20320, OTP-20322,
                         OTP-20326, OTP-20327, OTP-20328, OTP-20331,
                         OTP-20335, OTP-20338, OTP-20339, OTP-20352,
                         OTP-20354, OTP-20356, OTP-20358, OTP-20362,
                         OTP-20364, OTP-20365, OTP-20367, OTP-20373,
                         OTP-20374
Seq num:                 ERIERL-1356, GH-10879, GH-10968, GH-11093,
                         GH-11119, GH-11155, GH-11248, GH-11308,
                         GH-11338, GH-11344, GH-11349, GH-11351,
                         GH-11352, GH-11360, GH-11366, GH-11367,
                         GH-11397, GH-11398, GH-11401, GH-11406,
                         GH-11413, GH-11414, GH-11423, GH-11472,
                         GH-11534, GH-4417, GH-7862, GH-9302,
                         OTP-20102, PR-10297, PR-11074, PR-11096,
                         PR-11097, PR-11115, PR-11128, PR-11129,
                         PR-11130, PR-11133, PR-11137, PR-11144,
                         PR-11159, PR-11165, PR-11167, PR-11170,
                         PR-11196, PR-11203, PR-11216, PR-11226,
                         PR-11249, PR-11260, PR-11274, PR-11284,
                         PR-11300, PR-11313, PR-11316, PR-11324,
                         PR-11335, PR-11345, PR-11356, PR-11359,
                         PR-11361, PR-11363, PR-11375, PR-11376,
                         PR-11378, PR-11379, PR-11388, PR-11390,
                         PR-11391, PR-11396, PR-11410, PR-11422,
                         PR-11424, PR-11426, PR-11438, PR-11440,
                         PR-11442, PR-11444, PR-11446, PR-11447,
                         PR-11460, PR-11466, PR-11477, PR-11501,
                         PR-11505, PR-11507, PR-11530, PR-11552,
                         PR-11556, PR-11563, PR-11566, PR-11567,
                         PR-11570, PR-11574, PR-11600
System:                  OTP
Release:                 29
Application:             asn1-5.5.1, common_test-1.31.2,
                         compiler-10.0.5, crypto-5.10, dialyzer-6.0.3,
                         erts-17.1, inets-9.8, kernel-11.0.4,
                         mnesia-4.27, odbc-2.17.1, public_key-1.21.6,
                         runtime_tools-2.5, ssl-11.7.6, stdlib-8.1,
                         syntax_tools-4.1.1, tools-4.2.3, wx-2.7
Predecessor:             OTP 29.0.6

Check out the git tag OTP-29.1, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.

POTENTIAL INCOMPATIBILITIES

• When beam_lib returns an error tuple, the filename in the information tuple is now a list of characters instead of an atom.

  Example:

  1> beam_lib:chunks(code:which(lists), ["nope"]).
  {error,beam_lib,
         {missing_chunk,".../git/otp/lib/stdlib/ebin/lists.beam",
                        "nope"}}
  

  The reason for this change is that a long file name is not guaranteed to fit in an atom. Applications or tools that do deep inspection of the beam_lib errors (not recommended) will need to be updated.

  Own Id: OTP-20118
  Application(s): stdlib
  Related Id(s): [PR-11167]

OTP-29.1

Improvements and New Features

• A new [versions] module has been added to the runtime_tools application containing functions for, e.g., comparing, versions that adhere to the [OTP Versions Scheme].

  The documentation of the [OTP Versions Scheme] has also been improved.

  Own Id: OTP-20352
  Related Id(s): [PR-11556], [PR-11600]

asn1-5.5.1

The asn1-5.5.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

• The modern representation of BITSTRINGs is now always supported for encoding, regardless of any legacy options given. The JER backend would not support the modern representation when any legacy option was given.

  Own Id: OTP-20145
  Related Id(s): [PR-11097]

• The make clean command did not remove all generated .erl files.

  Own Id: OTP-20295
  Related Id(s): [PR-11375]

Full runtime dependencies of asn1-5.5.1

erts-14.0, kernel-9.0, stdlib-5.0

common_test-1.31.2

The common_test-1.31.2 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

• The internal cte_track event handler now correctly displays the suite name for suites without an init_per_suite/1 callback.

  Own Id: OTP-20316
  Related Id(s): [PR-11501]

Full runtime dependencies of common_test-1.31.2

compiler-10.0, crypto-4.5, debugger-4.1, erts-7.0, ftp-1.0, inets-6.0, kernel-11.0, observer-2.1, runtime_tools-1.8.16, sasl-2.5, snmp-5.1.2, ssh-4.0, stdlib-8.0, syntax_tools-1.7, tools-3.2, xmerl-1.3.8

compiler-10.0.5

The compiler-10.0.5 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

• Fixed a native record crash in the sys_core_fold compiler pass.

  Own Id: OTP-20254
  Related Id(s): [GH-11351], [PR-11359]

• The compiler could crash when compiling a map comprehension.

  Own Id: OTP-20255
  Related Id(s): [GH-11352], [PR-11363]

• Fixed a crash when the key pattern in a map comprehension was a bitstring.

  Own Id: OTP-20262
  Related Id(s): [GH-11367], [PR-11379]

• Fixed an issue that could crash the compiler when compiling comprehensions with the compr_assign feature enabled.

  Own Id: OTP-20267
  Related Id(s): [GH-11366], [PR-11390]

• Code that called erlang:0() inside a fun could crash the compiler.

  Own Id: OTP-20280
  Related Id(s): [GH-11414], [PR-11424]

• Fixed an internal error when lists:keyfind/3 is called with an argument that exceeds system limits.

  Own Id: OTP-20291
  Related Id(s): [GH-11413], [PR-11444]

• An incorrect useless_building warning has been eliminated.

  Own Id: OTP-20304
  Related Id(s): [GH-11472], [PR-11477]

• In rare circumstances, the type analysis pass of the compiler could run for many minutes.

  Own Id: OTP-20365
  Related Id(s): [GH-11534], [PR-11566]

Full runtime dependencies of compiler-10.0.5

crypto-5.1, erts-13.0, kernel-8.4, stdlib-8.0

crypto-5.10

The crypto-5.10 application can be applied independently of other applications on a full OTP 29 installation.

Improvements and New Features

• The documentation of the crypto module now contains runnable examples for most functions. The examples are verified by the crypto test suite, so they always match actual behavior.

  Own Id: OTP-20373
  Related Id(s): [PR-11170]

Full runtime dependencies of crypto-5.10

erts-9.0, kernel-6.0, stdlib-3.9

dialyzer-6.0.3

The dialyzer-6.0.3 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

• Fixed Dialyzer crash when overriding built-in types.

  Own Id: OTP-19631
  Related Id(s): [GH-11093], [PR-11096]

• Typer crashed when multiple functions were written in the same line. For example:

  -module(m).
  f() -> ok. g() -> ok.
  

  Own Id: OTP-20297
  Related Id(s): [PR-11466]

Full runtime dependencies of dialyzer-6.0.3

compiler-10.0, erts-12.0, kernel-8.0, stdlib-5.0, syntax_tools-2.0

erts-17.1

The erts-17.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

• Fixed bug in ets:member/2 for set, bag and duplicate_bag. The bug could (maybe) lead to ets:member spuriously returning false for a value which is actually a member for a table that faces high insert load.

  Own Id: OTP-20152
  Related Id(s): [PR-11115]

• Fixed crashing bug caused by race between timer creating process and suspending receiver of the timer. Only seen to cause crash one time by extremely provoking test case. Bug exists only since OTP 29.0.

  Own Id: OTP-20175
  Related Id(s): [PR-11196]

• Fixed bug in enif_realloc_binary when called with a read-only binary. Instead of returning false at out-of-memory failure, it returned true and did nothing.

  Own Id: OTP-20187
  Related Id(s): [PR-11133]

• Fixed alternate signal stack sizing on musl (Alpine) running on CPUs whose Linux kernel reports large signal frames (AVX-512/AMX). It caused emulator to abort during startup with "Failed to set alternate signal stack".

  Own Id: OTP-20213
  Related Id(s): [GH-11248], [PR-11249]

• For socket:recvmmsg/6, the buffer length was not handled correctly when the OS network stack truncated the received message, so garbage data with incorrect length could be delivered to the calling process. This bug has been corrected.

  Own Id: OTP-20246
  Related Id(s): [PR-11335]

• binary_to_term/1 will now reject an external native record with duplicated fields.

  Own Id: OTP-20276
  Related Id(s): [GH-11398], [PR-11410]

• Fixed a crash upon starting the emulator on systems with a ver...

Patch Package:           OTP 29.0.6
Git Tag:                 OTP-29.0.6
Date:                    2026-09-01
Trouble Report Id:       OTP-20135, OTP-20234, OTP-20264, OTP-20268,
                         OTP-20269, OTP-20270, OTP-20271, OTP-20274,
                         OTP-20278, OTP-20279, OTP-20281, OTP-20282,
                         OTP-20284, OTP-20286, OTP-20289, OTP-20296,
                         OTP-20300, OTP-20301, OTP-20302, OTP-20306,
                         OTP-20307, OTP-20308, OTP-20312, OTP-20319,
                         OTP-20321, OTP-20324, OTP-20330, OTP-20333,
                         OTP-20334, OTP-20342, OTP-20343, OTP-20344,
                         OTP-20345, OTP-20346, OTP-20347, OTP-20350,
                         OTP-20351
Seq num:                 CVE-2026-75538, ERIERL-1345, ERIERL-1354,
                         GH-11052, GH-11240, GH-11278, GH-11380,
                         GH-11404, GH-11416, GH-11419, GH-11494,
                         GH-11511, PR-11298, PR-11325, PR-11358,
                         PR-11417, PR-11425, PR-11428, PR-11429,
                         PR-11437, PR-11463, PR-11464, PR-11470,
                         PR-11478, PR-11481, PR-11485, PR-11492,
                         PR-11503, PR-11509, PR-11513, PR-11517,
                         PR-11521, PR-11533, PR-11538, PR-11539,
                         PR-11540, PR-11541, PR-11542, PR-11543,
                         PR-11544, PR-11545, PR-11546, PR-11547,
                         PR-11548, PR-11553, PR-11554
System:                  OTP
Release:                 29
Application:             compiler-10.0.4, crypto-5.9.3, eldap-1.3.1,
                         erl_interface-5.8.2, erts-17.0.6,
                         inets-9.7.2, megaco-4.9.2, mnesia-4.26.2,
                         public_key-1.21.5, snmp-5.20.5, ssh-6.0.5,
                         ssl-11.7.5, stdlib-8.0.4, tools-4.2.2
Predecessor:             OTP 29.0.5

Check out the git tag OTP-29.0.6, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.

compiler-10.0.4

The compiler-10.0.4 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

• compiler: Fix bug in beam_types:subtract/2 for bitstrings

  Own Id: OTP-20312
  Related Id(s): [GH-11494], [PR-11503]

Full runtime dependencies of compiler-10.0.4

crypto-5.1, erts-13.0, kernel-8.4, stdlib-8.0

crypto-5.9.3

The crypto-5.9.3 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

• Fixed type mismatch between ErlNifUInt64 and uint64_t in crypto NIF that caused incompatible-pointer warnings on macOS arm64 when passing DH parameters to OpenSSL.

  Own Id: OTP-20333
  Related Id(s): [GH-11511], [PR-11513]

Full runtime dependencies of crypto-5.9.3

erts-9.0, kernel-6.0, stdlib-3.9

eldap-1.3.1

The eldap-1.3.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

• eldap referral URL parsing now rejects a port component longer than 5 digits instead of attempting to convert an arbitrarily large digit string to an integer.

  Own Id: OTP-20345
  Related Id(s): [PR-11538] [CVE-2026-70409]

Full runtime dependencies of eldap-1.3.1

asn1-3.0, erts-6.0, kernel-3.0, ssl-5.3.4, stdlib-3.4

erl_interface-5.8.2

The erl_interface-5.8.2 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

• erl_interface: Fix buffer leak and state corruption on ei_x_buff realloc failure

  Own Id: OTP-20324
  Related Id(s): [PR-11492]

erts-17.0.6

The erts-17.0.6 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

• No-suspend port command signals (i.e. port command signals sent using the erlang:port_command/3 BIF or the erlang:send/3 BIF with the nosuspend option) were not aborted properly in all scenarios which could leave the port queue in a busy state indefinitely. Also asynchronously sent no-suspend command signals (i.e, port command signals sent using the erlang:send/3 BIF with the nosuspend option) could sometimes be delivered even though the port was busy.

  Own Id: OTP-20135
  Related Id(s): [GH-11052], [PR-11463]

• erts: Fix missing exit_status caused by SIGCHLD race

  Own Id: OTP-20274
  Related Id(s): [GH-11278], [PR-11298]

• erts: Fix bug in is_in_range instruction for x86 JIT

  Own Id: OTP-20278
  Related Id(s): [GH-11419], [PR-11429]

• Fixed bug in binary_to_term that could cause emulator crash for specific terms in specific process states (reductions left).

  Own Id: OTP-20281
  Related Id(s): [GH-11404], [PR-11425]

• erts: Fix crash with term_to_iovec/2 for large binary

  Own Id: OTP-20282
  Related Id(s): [PR-11428]

• A distributed priority send larger than 32 KiB to a process alias caused the receiving runtime system to crash.

  Own Id: OTP-20286
  Related Id(s): [GH-11416], [PR-11417]

• Priority message queue markers were sometimes installed in the message queue even when no priority messages could be received. As a result, the two markers had to be traversed unnecessarily when scanning the message queue, introducing a small but avoidable overhead.

  Own Id: OTP-20300
  Related Id(s): [PR-11485]

• A monitor of time_offset co-created with a process alias (monitor(time_offset, clock_service, [{alias, UnaliasOpt}])) either crashed the runtime system or did not work. This bug was introduced in OTP 25.0.

  Own Id: OTP-20319
  Related Id(s): [PR-11509]

• A process alias was erroneously created when a remote spawn_request() operation with a {monitor, [{alias, explicit_unalias}]} option failed with noconnection reason.

  Own Id: OTP-20330
  Related Id(s): [PR-11521]

• A gen_tcp socket using the inet driver and {packet,4} had a bug if receiving a packet with size just below INT_MAX.

  That packet size wrapped in size calculations and made the received data overwrite its allocation and trash allocator metadata and subsequent block(s), causing the VM to crash.

  This made it possible for anyone to remotely crash an Erlang node that used {packet,4} on a reachable socket.

  This bug has been corrected.

  Own Id: OTP-20334
  Related Id(s): [PR-11533], [CVE-2026-75538]

Full runtime dependencies of erts-17.0.6

kernel-9.0, sasl-3.3, stdlib-4.1

inets-9.7.2

The inets-9.7.2 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

• The dets and mnesia mod_auth backends used a key that did not include the directory path, so all require_user/require_group records collapsed into one per-listener namespace. A user authorized for one protected directory could authenticate against any other protected directory served by the same listener. {path, Directory} is now included in the auth backend key, scoping records per directory as documented.

  Own Id: OTP-20264
  Related Id(s): [PR-11546] [CVE-2026-74994]

• Requests specifying both Transfer-Encoding and Content-Length headers are now rejected with 400 Bad Request, per RFC 9112 Section 6.3. Previously such requests could be used for CL.TE request-smuggling/desync attacks against reverse proxies in front of httpd.

  Own Id: OTP-20268
  Related Id(s): [PR-11547] [CVE-2026-73812]

• httpd accepted the obsolete header line-folding syntax (RFC 9112 Section 5.2, a continuation line beginning with space/tab), silently treating the folded continuation as a separate header. This allowed CL.TE-style request smuggling when httpd was placed behind a folding-aware proxy. Such requests are now rejected with 400 Bad Request.

  Own Id: OTP-20269
  Related Id(s): [PR-11544] [CVE-2026-66357]

• A header such as Content-Length : 6 (whitespace before the colon) was previously silently dropped, causing the content length to default to 0 and the body bytes to be misinterpreted as a pipelined request (CL.0 smuggling). Per RFC 7230 Section 3.2.4, such headers are now rejected with 400 Bad Request.

  Own Id: OTP-20270
  Related Id(s): [PR-11545] [CVE-2026-73276]

• A new httpd option request_timeout (default 60 seconds, renamed from the interim max_body_read_timeout) bounds the idle time between reads of a request body/message. The server now also sends 408 Request Timeout when the min_bytes_per_second floor is hit, and keep_alive_timeout measurement was corrected so the timer is cancelled as soon as new data arrives rather than only after full header parsing; keep_alive_timeout and request_timeout now also accept infinity to disable the timeout.

  Own Id: OTP-20271
  Related Id(s): [PR-11543] [CVE-2026-71380]

• mod_auth, mod_security, and mod_get compared resolved filesystem paths against configured protected-directory patterns without normalizing repeated slashes or filesystem case. On case-insensitive filesystems (macOS, Windows) or with repeated slashes, a request could resolve to a protected resource while evading the directory match. Paths are now canonicalized (slash-collapsed, and case-normalized when the filesystem is case-insensitive) before the authorization decision.

  Own Id: OTP-20279
  Related Id(s): [PR-11542] [CVE-2026-73270] [CVE-2026-66835]

• A request with an invalid chunked transfer-encoding chunk size previously caused the httpd connection handler to hang indefinitely without requiring further input from the client. This leaked a process per request and could be used to exhaust server resources (denial of service). Invalid chunk sizes are now rejec...

Patch Package:           OTP 28.5.0.6
Git Tag:                 OTP-28.5.0.6
Date:                    2026-09-01
Trouble Report Id:       OTP-20135, OTP-20234, OTP-20264, OTP-20265,
                         OTP-20268, OTP-20269, OTP-20270, OTP-20271,
                         OTP-20274, OTP-20278, OTP-20279, OTP-20281,
                         OTP-20282, OTP-20284, OTP-20286, OTP-20289,
                         OTP-20296, OTP-20300, OTP-20302, OTP-20306,
                         OTP-20307, OTP-20308, OTP-20312, OTP-20319,
                         OTP-20320, OTP-20324, OTP-20330, OTP-20333,
                         OTP-20334, OTP-20342, OTP-20343, OTP-20344,
                         OTP-20345, OTP-20346, OTP-20347, OTP-20350,
                         OTP-20351
Seq num:                 CVE-2026-75538, ERIERL-1354, GH-11052,
                         GH-11278, GH-11308, GH-11380, GH-11404,
                         GH-11416, GH-11419, GH-11423, GH-11494,
                         GH-11511, PR-11298, PR-11325, PR-11388,
                         PR-11417, PR-11425, PR-11428, PR-11429,
                         PR-11437, PR-11463, PR-11464, PR-11478,
                         PR-11481, PR-11485, PR-11492, PR-11503,
                         PR-11505, PR-11509, PR-11513, PR-11517,
                         PR-11521, PR-11533, PR-11538, PR-11539,
                         PR-11540, PR-11541, PR-11542, PR-11543,
                         PR-11544, PR-11545, PR-11546, PR-11547,
                         PR-11548, PR-11553, PR-11554
System:                  OTP
Release:                 28
Application:             compiler-9.0.6.2, crypto-5.8.3.3,
                         eldap-1.2.16.1, erl_interface-5.7.0.2,
                         erts-16.4.0.6, inets-9.6.2.3,
                         kernel-10.6.3.4, megaco-4.8.3.2,
                         mnesia-4.25.3.2, snmp-5.20.2.2, ssh-5.5.2.5,
                         ssl-11.6.0.5, stdlib-7.3.0.2, tools-4.1.4.1
Predecessor:             OTP 28.5.0.5

Check out the git tag OTP-28.5.0.6, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.

compiler-9.0.6.2

The compiler-9.0.6.2 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

• compiler: Fix bug in beam_types:subtract/2 for bitstrings

  Own Id: OTP-20312 Related Id(s): GH-11494, PR-11503

Full runtime dependencies of compiler-9.0.6.2

crypto-5.1, erts-13.0, kernel-8.4, stdlib-6.0

crypto-5.8.3.3

The crypto-5.8.3.3 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

• Fixed type mismatch between ErlNifUInt64 and uint64_t in crypto NIF that caused incompatible-pointer warnings on macOS arm64 when passing DH parameters to OpenSSL.

  Own Id: OTP-20333 Related Id(s): GH-11511, PR-11513

Full runtime dependencies of crypto-5.8.3.3

erts-9.0, kernel-6.0, stdlib-3.9

eldap-1.2.16.1

The eldap-1.2.16.1 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

• eldap referral URL parsing now rejects a port component longer than 5 digits instead of attempting to convert an arbitrarily large digit string to an integer.

  Own Id: OTP-20345 Related Id(s): PR-11538 CVE-2026-70409

Full runtime dependencies of eldap-1.2.16.1

asn1-3.0, erts-6.0, kernel-3.0, ssl-5.3.4, stdlib-3.4

erl_interface-5.7.0.2

The erl_interface-5.7.0.2 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

• erl_interface: Fix buffer leak and state corruption on ei_x_buff realloc failure

  Own Id: OTP-20324 Related Id(s): PR-11492

erts-16.4.0.6

The erts-16.4.0.6 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

• No-suspend port command signals (i.e. port command signals sent using the erlang:port_command/3 BIF or the erlang:send/3 BIF with the nosuspend option) were not aborted properly in all scenarios which could leave the port queue in a busy state indefinitely. Also asynchronously sent no-suspend command signals (i.e, port command signals sent using the erlang:send/3 BIF with the nosuspend option) could sometimes be delivered even though the port was busy.

  Own Id: OTP-20135 Related Id(s): GH-11052, PR-11463

• erts: Fix missing exit_status caused by SIGCHLD race

  Own Id: OTP-20274 Related Id(s): GH-11278, PR-11298

• erts: Fix bug in is_in_range instruction for x86 JIT

  Own Id: OTP-20278 Related Id(s): GH-11419, PR-11429

• Fixed bug in binary_to_term that could cause emulator crash for specific terms in specific process states (reductions left).

  Own Id: OTP-20281 Related Id(s): GH-11404, PR-11425

• erts: Fix crash with term_to_iovec/2 for large binary

  Own Id: OTP-20282 Related Id(s): PR-11428

• A distributed priority send larger than 32 KiB to a process alias caused the receiving runtime system to crash.

  Own Id: OTP-20286 Related Id(s): GH-11416, PR-11417

• Priority message queue markers were sometimes installed in the message queue even when no priority messages could be received. As a result, the two markers had to be traversed unnecessarily when scanning the message queue, introducing a small but avoidable overhead.

  Own Id: OTP-20300 Related Id(s): PR-11485

• A monitor of time_offset co-created with a process alias (monitor(time_offset, clock_service, [{alias, UnaliasOpt}])) either crashed the runtime system or did not work. This bug was introduced in OTP 25.0.

  Own Id: OTP-20319 Related Id(s): PR-11509

• A process alias was erroneously created when a remote spawn_request() operation with a {monitor, [{alias, explicit_unalias}]} option failed with noconnection reason.

  Own Id: OTP-20330 Related Id(s): PR-11521

• A gen_tcp socket using the inet driver and {packet,4} had a bug if receiving a packet with size just below INT_MAX.

  That packet size wrapped in size calculations and made the received data overwrite its allocation and trash allocator metadata and subsequent block(s), causing the VM to crash.

  This made it possible for anyone to remotely crash an Erlang node that used {packet,4} on a reachable socket.

  This bug has been corrected.

  Own Id: OTP-20334 Related Id(s): PR-11533, CVE-2026-75538

Full runtime dependencies of erts-16.4.0.6

kernel-9.0, sasl-3.3, stdlib-4.1

inets-9.6.2.3

The inets-9.6.2.3 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

• The dets and mnesia mod_auth backends used a key that did not include the directory path, so all require_user/require_group records collapsed into one per-listener namespace. A user authorized for one protected directory could authenticate against any other protected directory served by the same listener. {path, Directory} is now included in the auth backend key, scoping records per directory as documented.

  Own Id: OTP-20264 Related Id(s): PR-11546 CVE-2026-74994

• Requests specifying both Transfer-Encoding and Content-Length headers are now rejected with 400 Bad Request, per RFC 9112 Section 6.3. Previously such requests could be used for CL.TE request-smuggling/desync attacks against reverse proxies in front of httpd.

  Own Id: OTP-20268 Related Id(s): PR-11547 CVE-2026-73812

• httpd accepted the obsolete header line-folding syntax (RFC 9112 Section 5.2, a continuation line beginning with space/tab), silently treating the folded continuation as a separate header. This allowed CL.TE-style request smuggling when httpd was placed behind a folding-aware proxy. Such requests are now rejected with 400 Bad Request.

  Own Id: OTP-20269 Related Id(s): PR-11544 CVE-2026-66357

• A header such as Content-Length : 6 (whitespace before the colon) was previously silently dropped, causing the content length to default to 0 and the body bytes to be misinterpreted as a pipelined request (CL.0 smuggling). Per RFC 7230 Section 3.2.4, such headers are now rejected with 400 Bad Request.

  Own Id: OTP-20270 Related Id(s): PR-11545 CVE-2026-73276

• A new httpd option request_timeout (default 60 seconds, renamed from...

Patch Package:           OTP 27.3.4.17
Git Tag:                 OTP-27.3.4.17
Date:                    2026-09-01
Trouble Report Id:       OTP-20135, OTP-20234, OTP-20264, OTP-20265,
                         OTP-20268, OTP-20269, OTP-20270, OTP-20271,
                         OTP-20273, OTP-20278, OTP-20279, OTP-20281,
                         OTP-20282, OTP-20284, OTP-20289, OTP-20296,
                         OTP-20302, OTP-20306, OTP-20307, OTP-20308,
                         OTP-20312, OTP-20319, OTP-20320, OTP-20324,
                         OTP-20330, OTP-20333, OTP-20334, OTP-20342,
                         OTP-20343, OTP-20344, OTP-20345, OTP-20346,
                         OTP-20347, OTP-20349, OTP-20351
Seq num:                 CVE-2026-75538, ERIERL-1352, GH-11052,
                         GH-11278, GH-11308, GH-11380, GH-11404,
                         GH-11419, GH-11423, GH-11494, GH-11511,
                         OTP-20037, OTP-20199, PR-11247, PR-11285,
                         PR-11325, PR-11388, PR-11425, PR-11428,
                         PR-11429, PR-11437, PR-11463, PR-11464,
                         PR-11478, PR-11481, PR-11492, PR-11503,
                         PR-11505, PR-11509, PR-11513, PR-11517,
                         PR-11521, PR-11533, PR-11538, PR-11539,
                         PR-11540, PR-11541, PR-11542, PR-11543,
                         PR-11544, PR-11545, PR-11546, PR-11547,
                         PR-11548, PR-11554
System:                  OTP
Release:                 27
Application:             compiler-8.6.1.6, crypto-5.5.3.5,
                         eldap-1.2.14.2, erl_interface-5.5.2.2,
                         erts-15.2.7.13, inets-9.3.2.7,
                         kernel-10.2.7.5, megaco-4.7.2.3,
                         mnesia-4.23.5.4, snmp-5.18.2.1,
                         ssh-5.2.11.12, ssl-11.2.12.12,
                         stdlib-6.2.2.5, tools-4.1.1.1
Predecessor:             OTP 27.3.4.16

Check out the git tag OTP-27.3.4.17, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.

compiler-8.6.1.6

The compiler-8.6.1.6 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

• compiler: Fix bug in beam_types:subtract/2 for bitstrings

  Own Id: OTP-20312 Related Id(s): GH-11494, PR-11503

Full runtime dependencies of compiler-8.6.1.6

crypto-5.1, erts-13.0, kernel-8.4, stdlib-6.0

crypto-5.5.3.5

The crypto-5.5.3.5 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

• Fixed type mismatch between ErlNifUInt64 and uint64_t in crypto NIF that caused incompatible-pointer warnings on macOS arm64 when passing DH parameters to OpenSSL.

  Own Id: OTP-20333 Related Id(s): GH-11511, PR-11513

Full runtime dependencies of crypto-5.5.3.5

erts-9.0, kernel-5.3, stdlib-3.9

eldap-1.2.14.2

The eldap-1.2.14.2 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

• eldap referral URL parsing now rejects a port component longer than 5 digits instead of attempting to convert an arbitrarily large digit string to an integer.

  Own Id: OTP-20345 Related Id(s): PR-11538 CVE-2026-70409

Full runtime dependencies of eldap-1.2.14.2

asn1-3.0, erts-6.0, kernel-3.0, ssl-5.3.4, stdlib-3.4

erl_interface-5.5.2.2

The erl_interface-5.5.2.2 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

• erl_interface: Fix buffer leak and state corruption on ei_x_buff realloc failure

  Own Id: OTP-20324 Related Id(s): PR-11492

erts-15.2.7.13

The erts-15.2.7.13 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

• No-suspend port command signals (i.e. port command signals sent using the erlang:port_command/3 BIF or the erlang:send/3 BIF with the nosuspend option) were not aborted properly in all scenarios which could leave the port queue in a busy state indefinitely. Also asynchronously sent no-suspend command signals (i.e, port command signals sent using the erlang:send/3 BIF with the nosuspend option) could sometimes be delivered even though the port was busy.

  Own Id: OTP-20135 Related Id(s): GH-11052, PR-11463

• erts: Fix missing exit_status caused by SIGCHLD race

  Own Id: OTP-20273 Related Id(s): GH-11278, PR-11285

• erts: Fix bug in is_in_range instruction for x86 JIT

  Own Id: OTP-20278 Related Id(s): GH-11419, PR-11429

• Fixed bug in binary_to_term that could cause emulator crash for specific terms in specific process states (reductions left).

  Own Id: OTP-20281 Related Id(s): GH-11404, PR-11425

• erts: Fix crash with term_to_iovec/2 for large binary

  Own Id: OTP-20282 Related Id(s): PR-11428

• A monitor of time_offset co-created with a process alias (monitor(time_offset, clock_service, [{alias, UnaliasOpt}])) either crashed the runtime system or did not work. This bug was introduced in OTP 25.0.

  Own Id: OTP-20319 Related Id(s): PR-11509

• A process alias was erroneously created when a remote spawn_request() operation with a {monitor, [{alias, explicit_unalias}]} option failed with noconnection reason.

  Own Id: OTP-20330 Related Id(s): PR-11521

• A gen_tcp socket using the inet driver and {packet,4} had a bug if receiving a packet with size just below INT_MAX.

  That packet size wrapped in size calculations and made the received data overwrite its allocation and trash allocator metadata and subsequent block(s), causing the VM to crash.

  This made it possible for anyone to remotely crash an Erlang node that used {packet,4} on a reachable socket.

  This bug has been corrected.

  Own Id: OTP-20334 Related Id(s): PR-11533, CVE-2026-75538

Full runtime dependencies of erts-15.2.7.13

kernel-9.0, sasl-3.3, stdlib-4.1

inets-9.3.2.7

The inets-9.3.2.7 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

• The dets and mnesia mod_auth backends used a key that did not include the directory path, so all require_user/require_group records collapsed into one per-listener namespace. A user authorized for one protected directory could authenticate against any other protected directory served by the same listener. {path, Directory} is now included in the auth backend key, scoping records per directory as documented.

  Own Id: OTP-20264 Related Id(s): PR-11546 CVE-2026-74994

• Requests specifying both Transfer-Encoding and Content-Length headers are now rejected with 400 Bad Request, per RFC 9112 Section 6.3. Previously such requests could be used for CL.TE request-smuggling/desync attacks against reverse proxies in front of httpd.

  Own Id: OTP-20268 Related Id(s): PR-11547 CVE-2026-73812

• httpd accepted the obsolete header line-folding syntax (RFC 9112 Section 5.2, a continuation line beginning with space/tab), silently treating the folded continuation as a separate header. This allowed CL.TE-style request smuggling when httpd was placed behind a folding-aware proxy. Such requests are now rejected with 400 Bad Request.

  Own Id: OTP-20269 Related Id(s): PR-11544 CVE-2026-66357

• A header such as Content-Length : 6 (whitespace before the colon) was previously silently dropped, causing the content length to default to 0 and the body bytes to be misinterpreted as a pipelined request (CL.0 smuggling). Per RFC 7230 Section 3.2.4, such headers are now rejected with 400 Bad Request.

  Own Id: OTP-20270 Related Id(s): PR-11545 CVE-2026-73276

• A new httpd option request_timeout (default 60 seconds, renamed from the interim max_body_read_timeout) bounds the idle time between reads of a request body/message. The server now also sends 408 Request Timeout when the min_bytes_per_second floor is hit, and keep_alive_timeout measurement was corrected so the timer is cancelled as soon as new data arrives rather than only after full header parsing; keep_alive_timeout and request_timeout now also accept infinity to disable the timeout.

  Own Id: OTP-20271 Related Id(s): PR-11543 CVE-2026-71380

• mod_auth, mod_security, and mod_get co...