Update dependency erlang to v29 - #1230
Merged
Merged
Conversation
renovate
Bot
force-pushed
the
renovate/erlang-29.x
branch
from
June 10, 2026 10:07
3b28d7d to
1ca2f83
Compare
renovate
Bot
force-pushed
the
renovate/erlang-29.x
branch
from
June 24, 2026 10:37
1ca2f83 to
21b960e
Compare
renovate
Bot
force-pushed
the
renovate/erlang-29.x
branch
2 times, most recently
from
July 7, 2026 20:30
deef747 to
8ac9bbb
Compare
renovate
Bot
force-pushed
the
renovate/erlang-29.x
branch
from
July 17, 2026 02:04
8ac9bbb to
9f0ec49
Compare
renovate
Bot
force-pushed
the
renovate/erlang-29.x
branch
5 times, most recently
from
August 11, 2026 13:59
fbf13db to
9a21a89
Compare
renovate
Bot
force-pushed
the
renovate/erlang-29.x
branch
2 times, most recently
from
August 21, 2026 01:39
f8a9f79 to
9a80e3b
Compare
Container Scanning Status: ❌ Failure |
renovate
Bot
force-pushed
the
renovate/erlang-29.x
branch
from
August 26, 2026 20:25
9a80e3b to
1e809c5
Compare
Contributor
Author
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
tpendragon
approved these changes
Aug 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
27.3.4→29.0.527.3.4.16→29.0.5Release Notes
erlang/otp (erlang)
v29.0.5: OTP 29.0.5Compare Source
Check out the git tag OTP-29.0.5, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.
erts-17.0.5
The erts-17.0.5 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Fixed a regression in the previous patch release that prevented epmd from binding to localhost.
Own Id: OTP-20275
Related Id(s): GH-11402, PR-11409
ssh-6.0.4
The ssh-6.0.4 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
The SSH client and server now reject incoming packets not aligned to the cipher block size as required by RFC 4253 §6. For CBC ciphers, a timing-safe "packet discard" mechanism (CVE-2008-5161 mitigation) ensures structural errors are indistinguishable from MAC failures before disconnecting. AEAD and encrypt-then-MAC modes disconnect immediately.
Own Id: OTP-20137
Related Id(s): PR-11110
v29.0.4: OTP 29.0.4Compare Source
Check out the git tag OTP-29.0.4, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.
POTENTIAL INCOMPATIBILITIES
Mitigated a denial of service attack in epmd.
Thanks to Ryan Moore for finding and responsibly disclosing this vulnerability to the Erlang/OTP project.
Own Id: OTP-20136
Application(s): erts
Related Id(s): PR-11386, CVE-2026-42792
compiler-10.0.3
The compiler-10.0.3 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
compiler: Fix an internal consistency check failure with
setelementOwn Id: OTP-20261
Related Id(s): GH-11368, PR-11374
crypto-5.9.2
The crypto-5.9.2 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Fixed crash in
crypto:macN/5when suppliedMacLengthwas greater than length of what the underlying hash returned.Own Id: OTP-20239
Related Id(s): PR-11239
Fixed segfault in
crypto:aead_cipher_init_nifwhen argument validation fails.Own Id: OTP-20241
Related Id(s): PR-11330
Fix cipher key buffer overread for
chacha20_poly1305.Own Id: OTP-20244
Related Id(s): PR-11337
diameter-2.7.2
The diameter-2.7.2 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Fix infinite loop in
diameter_dist:route_session/2when avp other thanSession-Idhas zero length.Own Id: OTP-20242
Related Id(s): PR-11331
Fix crash in
diameter_dist:route_session/2whenSession-Id(code: 263) avp has zero length.Own Id: OTP-20243
Related Id(s): PR-11333
erts-17.0.4
The erts-17.0.4 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Mitigated a denial of service attack in epmd.
Thanks to Ryan Moore for finding and responsibly disclosing this vulnerability to the Erlang/OTP project.
Own Id: OTP-20136
Related Id(s): PR-11386, CVE-2026-42792
*** POTENTIAL INCOMPATIBILITY ***
Fixed heap corruption when an invalidly encoded tuple with an arity of 2^31 or larger is decoded from Erlang's External Term Format (binary_to_term).
Own Id: OTP-20214
Related Id(s): PR-11297, CVE-2026-55737
When send_timeout is set and send_timeout_close is set to true, a 'tcp_closed' message is expected when the timeout occurs, but that (message) was not delivered. This has now been fixed.
Own Id: OTP-20257
Related Id(s): GH-11319
A crafted External Term Format (ETF) payload could crash the runtime system.
Thanks to Paul Guyot for finding and responsibly disclosing this vulnerability to the Erlang/OTP project.
Own Id: OTP-20259
Related Id(s): PR-11386, CVE-2026-54890
Fixed a rounding error in 16-bit float conversion.
Own Id: OTP-20260
Related Id(s): GH-11332, PR-11334
megaco-4.9.1
The megaco-4.9.1 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Fixed a buffer overflow in the megaco flex scanner C driver. A property parm name exceeding 452 bytes in a text-encoded H.248 message could overflow a fixed-size error buffer, crashing the VM. The sprintf calls have been replaced with bounded snprintf.
Own Id: OTP-20237
Related Id(s): GH-SA-7xgh-gmgf-q2g7, PR-11323
public_key-1.21.4
The public_key-1.21.4 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
A certificate chain with crafted policyMappings extensions could cause exponential memory consumption during path validation, exploitable via TLS handshake. Chains exceeding a node-count cap are now rejected with {bad_cert, policy_tree_exceeded}.
Own Id: OTP-20251
Related Id(s): GH-SA-622p-qfh6-c352, PR-11372
ssh-6.0.3
The ssh-6.0.3 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
DH key exchange now enforces strict bounds (1 < e/f < p-1, 1 < K < p-1) on all paths, matching OpenSSH and Go. No interop impact.
Own Id: OTP-20229
Related Id(s): PR-11303
Validate DH group parameters (P, G) received from the server during DH-GEX key exchange. The client now rejects groups where P is smaller than 2048 bits or G is not in the range (1, P-1). The default minimum in dh_gex_limits has been raised to 2048 on both client and server.
Own Id: OTP-20258
Related Id(s): ERIERL-1341, PR-11369
ssl-11.7.4
Note! The ssl-11.7.4 application cannot be applied independently of other applications on an arbitrary OTP 29 installation.
Fixed Bugs and Malfunctions
Add pre TLS-1.3 client side validation of servers algorithm selection being part of clients offered algorithms, preventing in worst case MITM circumventing validation of server certificate tricking the client to trust the malicious MITM as it was a valid server. Note this check is already performed for TLS-1.3 clients.
Own Id: OTP-20240
Related Id(s): PR-11336, CVE-2026-55953
Prevent invalid cert chains to create cycles in chain building code used to handle chains that could be unordered or contain extraneous certs. This avoids a DoS attack possibility.
Own Id: OTP-20245
Related Id(s): PR-11343, CVE-2026-58227
Clarify that rsa_psk and anonymous key exchange algorithms are considered legacy. Also harden rsa_psk in same way as normal rsa key exchange.
Own Id: OTP-20248
Related Id(s): PR-11341
Harden SSL application to conform with best practice and RFC's. This will mostly improve error messages and conserve memory usage.
Own Id: OTP-20250
Related Id(s): PR-27944
A certificate chain with crafted policyMappings extensions could cause exponential memory consumption during path validation, exploitable via TLS handshake. Chains exceeding a node-count cap are now rejected with {bad_cert, policy_tree_exceeded}.
Own Id: OTP-20251
Related Id(s): GH-SA-622p-qfh6-c352, PR-11372
stdlib-8.0.3
The stdlib-8.0.3 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Fixed a bug where zip:unzip/1,2 and zip:extract/1,2 were vulnerable to a relative path traversal attack. A crafted zip archive containing entry names such as ../x/y could have caused files to be written outside the intended extraction directory.
Thanks to Jonatan Männchen and Zhang Delong for finding and responsibly disclosing this vulnerability to the Erlang/OTP project.
Own Id: OTP-20143
Related Id(s): PR-11386, CVE-2026-47078
Thanks to
a1x-an, Jonatan Männchen
v29.0.3: OTP 29.0.3Compare Source
Check out the git tag OTP-29.0.3, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.
common_test-1.31.1
The common_test-1.31.1 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Fixed a crash in ct_netconfc that occurred when the remote server closed the SSH connection during NETCONF subsystem negotiation.
Own Id: OTP-20191
Related Id(s): ERIERL-1333, PR-11230
compiler-10.0.2
The compiler-10.0.2 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Several compiler bugs that could crash the compiler or generate incorrect code in rare circumstances have been fixed.
Own Id: OTP-20222
Related Id(s): PR-11219
crypto-5.9.1
The crypto-5.9.1 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
crypto:compute_key/4foreddhandcrypto:generate_key/2,3foreddh/eddsanow raise anerror:{notsup, Info, Description}exception instead of returning the atomnotsupwhen the underlying cryptolib lacks support.Own Id: OTP-20215
Related Id(s): PR-11302
dialyzer-6.0.2
The dialyzer-6.0.2 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Fix a bug with native record sets in
erl_types.erlOwn Id: OTP-20201
erts-17.0.3
The erts-17.0.3 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Fixed an undefined behavior in the internal
erts_qsort()function, which could have been the cause of a beam crash seen when updating large maps.Own Id: OTP-20185
Related Id(s): PR-11215
Calculating
bxorof the largest supported positive integer (erlang:system_info(max_integer)) and-1would return[]instead of a raising asystem_limitexception.Own Id: OTP-20208
Related Id(s): PR-11269
Fix possible race between
ets:delete/1and terminating process with a fixation on the same table.Own Id: OTP-20217
Related Id(s): PR-11283
A few code generation issues for the JIT on AArch64 (ARM64) have been fixed.
For all platforms, the loader will reject some invalid BEAM files earlier.
Own Id: OTP-20226
Related Id(s): PR-11299
On 32-bit computers, the
md5BIFs would return an incorrect MD5 checksum for data of size 4GiB or more.Own Id: OTP-20227
Related Id(s): PR-11289
kernel-11.0.3
The kernel-11.0.3 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
inet:info/1 could crash when calling for a closing (port) socket.
Own Id: OTP-20173
Handling of the truncation bit in
inet_reshas been fixed so it properly falls back to querying over TCP after a truncated UDP reply.This fixes a bug introduced in OTP-28.4.2 - kernel-10.6.2 making a truncated UDP answer fail to parse and never execute the fallback, instead the name resolve operation fails.
Own Id: OTP-20199
Related Id(s): PR-11247
public_key-1.21.3
The public_key-1.21.3 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Hardened OCSP response verification by using constant-time hash comparisons and rejecting responses exceeding 100 KB before ASN.1 decoding.
Own Id: OTP-20197
Related Id(s): PR-11239
ssh-6.0.2
The ssh-6.0.2 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Fixed a path-existence oracle in the SFTP server where
SSH_FXP_REALPATHrequests with..components could bypass the configured root directory isolation, allowing an authenticated client to determine whether arbitrary paths exist on the host filesystem.Own Id: OTP-20183
Related Id(s): GH-SA-h9pw-h5w4-h976, PR-11294, CVE-2026-53422
Fixed an infinite loop in the SFTP server triggered when receiving
SSH_MSG_CHANNEL_EXTENDED_DATAon an SFTP channel, which caused the channel process to spin indefinitely on CPU without consuming its message queue.Own Id: OTP-20186
Related Id(s): GH-SA-7wp4-pc27-2vj9, PR-11295, CVE-2026-54886
Fixed mlkem768x25519 hybrid key exchange failing intermittently with "incorrect signature" when the X25519 shared secret had a leading zero byte. The shared secret is now encoded as a fixed-width 32-byte string per the specification.
Own Id: OTP-20196
Related Id(s): PR-11209
Fixed a race condition where SSH keepalive responses could be matched to unrelated pending requests due to incorrect request queue ordering. Requests are now matched in the order they were sent.
Own Id: OTP-20198
Related Id(s): PR-11244
The SFTP server now caps the read length in
SSH_FXP_READrequests to 255 KiB (matching OpenSSH'sSFTP_MAX_READ_LENGTH), preventing excessive memory allocation when clients request large reads.Own Id: OTP-20200
Related Id(s): PR-11259
Removed a server-side workaround (OTP-14827, introduced in OTP 20) that accepted SHA-1 user-auth signatures from clients identifying as OpenSSH 7.x when rsa-sha2-* was negotiated. The workaround addressed a distro-specific build issue in 2017 that no longer exists. Clients affected by this removal (extremely unlikely — requires a 10-year-old unpatched OpenSSH build) will see authentication failures and must upgrade.
Own Id: OTP-20206
Related Id(s): PR-11268
ssl-11.7.3
Note! The ssl-11.7.3 application cannot be applied independently of other applications on an arbitrary OTP 29 installation.
Fixed Bugs and Malfunctions
Correct small behavior bugs that occasionally could cause DTLS connection errors, unwanted behavior for legacy DHE_DSS, hiding of a distribution config error, and possible unorderly process tree shutdown.
Own Id: OTP-20190
Related Id(s): PR-11250
Initialize DTLS cookie to random value to avoid DoS attack with forged cookie during startup window.
Own Id: OTP-20194
Related Id(s): PR-11271, CVE-2026-54887
Guard TLS client for MITM injection of application data during "plain-text-window" during handshake.
Own Id: OTP-20207
Related Id(s): PR-11270, CVE-2026-54891
Improve error handling of TLS PSK sending ILLIGAL_PARMETER alert if binders and PSK-identities are not matched. Also mend recovery mechanism of ticket and session stores to be as resilient as possible to intermediate bugs.
Own Id: OTP-20216
Related Id(s): PR-11282, CVE-2026-55952
Fix race condition that could be used to DoS attack DTLS servers.
Own Id: OTP-20220
Related Id(s): PR-11306, CVE-2026-55950
A TLS-1.3 stateless session ticket with obfuscated_ticket_age set to zero was incorrectly accepted without checking the server-side ticket lifetime or the RFC 8446 Section 8.3 freshness window. The server now always validates ticket age using its own timestamp regardless of the client-reported age value.
Own Id: OTP-20230
Related Id(s): PR-11307
TLS-1.3 client rejects a second HelloRetryRequest as requiered in RFC 8446 Section 4.1.4
Own Id: OTP-20231
Related Id(s): PR-11309
A busy client node could self-trigger a ticket store crash if unlucky with scheduling if auto mode is used.
Own Id: OTP-20232
Related Id(s): PR-11311
Correct spec for CRL API
Own Id: OTP-20233
Related Id(s): PR-11281
stdlib-8.0.2
The stdlib-8.0.2 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Several compiler bugs that could crash the compiler or generate incorrect code in rare circumstances have been fixed.
Own Id: OTP-20222
Related Id(s): PR-11219
Thanks to
Cole Christensen, Nick Krichevsky, Stefan Grundmann
v29.0.2: OTP 29.0.2Compare Source
Check out the git tag OTP-29.0.2, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.
dialyzer-6.0.1
The dialyzer-6.0.1 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Fix native record bugs in Dialyzer
Own Id: OTP-20178
Related Id(s): PR-11199
diameter-2.7.1
The diameter-2.7.1 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Fixed return value documentation of
diameter:service_info(SvcName, statistics)Own Id: OTP-20150
Related Id(s): GH-11105, PR-11146
erl_interface-5.8.1
The erl_interface-5.8.1 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Fixed stack overflow in
ei_s_print_termfor very big integer terms (> 2000 hexadecimal digits long).Own Id: OTP-20160
Related Id(s): GH-SA-xcxj-5pg2-v72j, PR-11193, CVE-2026-49760
erts-17.0.2
The erts-17.0.2 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
A buffer overflow error when parsing SCTP ERROR or ABORT chunks has been fixed.
This could lead to stack corruption and VM crash, but ultimately with hard work by an attacker be refined into maybe even remote code execution.
Own Id: OTP-20165
Related Id(s): GH-SA-6f4f-chj5-5g97, PR-1234, CVE-2026-49759
ftp-1.2.6
The ftp-1.2.6 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
FTP client default connections that use the so called passive mode of FTP fails to properly validating the response IP of the server, hence a malicious or compromised FTP server could redirect the data connection to an arbitrary host, enabling s server-side request forgery (SSRF) and FTP bounce attacks.
Own Id: OTP-20166
Related Id(s): GH-SA-24cv-hwgr-37fq, PR-11186, CVE-2026-48858
inets-9.7.1
The inets-9.7.1 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
The HTTP client (httpc) now removes Authorization, Proxy-Authorization, Cookie, Referer, and Origin headers when following a redirect to a different host or port. Previously these headers were forwarded verbatim, potentially leaking credentials to unintended targets.
This follows the requirements of RFC 9110 §15.4.
Own Id: OTP-20155
Related Id(s): GH-SA-m75x-4vwg-ggjh, PR-11212, CVE-2026-48856
kernel-11.0.2
The kernel-11.0.2 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
gen_tcp_socket accept should explicitly inherit the same options as plain gen_tcp.
Own Id: OTP-20057
mnesia-4.26.1
The mnesia-4.26.1 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Fixed docs of
mnesia:write/3to clarify when a transaction can terminate.Own Id: OTP-20149
Related Id(s): GH-11104, PR-11145
public_key-1.21.2
The public_key-1.21.2 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Add missing macro reference for legacy algorithms md5 and sha224. This mainly improves error handling.
Own Id: OTP-20172
Related Id(s): PR-11195
ssh-6.0.1
The ssh-6.0.1 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Fixed a timing-based username enumeration vulnerability during password authentication with the user_passwords option. A dummy PBKDF2 computation is now performed for invalid usernames to match the response time of valid ones.
Own Id: OTP-20153
Related Id(s): GH-SA-3w6p-vwhf-wvp4, PR-11157, CVE-2026-48859
Fixed SSH_FXP_READLINK handler in ssh_sftpd to strip the backend root prefix from symlink targets before returning them to the client, preventing disclosure of the server's absolute filesystem path when the root option is configured.
Own Id: OTP-20162
Related Id(s): GH-SA-pv7g-pjrq-x2fh, PR-11192, CVE-2026-48855
Fixed a race condition where SSH keep-alive responses could consume pending channel open requests, causing channel setup to fail silently.
Own Id: OTP-20181
Related Id(s): PR-11205
ssl-11.7.2
Note! The ssl-11.7.2 application cannot be applied independently of other applications on an arbitrary OTP 29 installation.
Fixed Bugs and Malfunctions
Fix miscellanies issues that could cause unnecessary memory consumption and in some less common scenarios or configurations cause connection failures.
Own Id: OTP-20154
Related Id(s): PR-11148
Erlang distribution over TLS run with the kernel 'check_ip' flag now properly enforce connecting nodes to be on the same LAN.
Own Id: OTP-20156
Related Id(s): GH-SA-gp7x-mfv6-52cv, PR-11181, CVE-2026-48860
Enhance error message, by fixing typo of atom in new error message related to `public_key` CVE-2026-42790 solution.
Own Id: OTP-20161
Related Id(s): PR-11148
Corrected SNI handling for TLS-1.3 only server, could cause connection failures if supported signature algorithms where changed by SNI option update.
Own Id: OTP-20174
Related Id(s): PR-27384
stdlib-8.0.1
The stdlib-8.0.1 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Fix a bug where a tuple record operation within a native record anonymous update can crash.
Own Id: OTP-20151
Related Id(s): PR-11141
Fixed some bugs in
io_lib:bformat/2and native record printing.Own Id: OTP-20170
Related Id(s): PR-11154
tools-4.2.1
The tools-4.2.1 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Xref could crash instead of returning an appropriate error tuple when asked to open a BEAM file without debug information but with a
moduledoc(false)attribute.Own Id: OTP-20163
Related Id(s): GH-11152, PR-11168
Thanks to
John Downey, Jonatan Männchen
v29.0.1: OTP 29.0.1Compare Source
Check out the git tag OTP-29.0.1, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.
POTENTIAL INCOMPATIBILITIES
'public_key', Adhere to RFC 9525, and remove support for legacy fallback to check hostname against subject common name. Also improve error handling creating two separate errors for name constraint check for subject names and subject alternative names.
'ssl'. Error handling is slightly changed to better reflect public_key behaviour.
Own Id: OTP-20130
Application(s): public_key, ssl
Related Id(s): PR-11124, CVE-2026-42790
compiler-10.0.1
The compiler-10.0.1 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
In rare circumstances, optimization of boolean expressions could invert the boolean value.
Own Id: OTP-20140
Related Id(s): GH-11088, PR-11089
The compiler could crash when compiling code using native records in certain ways.
Own Id: OTP-20146
Related Id(s): PR-11135
erts-17.0.1
The erts-17.0.1 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Comparison of two native records could return an incorrect result or crash the runtime system.
Own Id: OTP-20139
Related Id(s): PR-11107
kernel-11.0.1
The kernel-11.0.1 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
SCTP peeloff of an IPv6 socket, the peeled-off socket does not inherit the parent options as expected.
Own Id: OTP-20134
Related Id(s): PR-11007
public_key-1.21.1
The public_key-1.21.1 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
OCSP responder certificates are now checked for expiration before being accepted as authorized responders. Previously, expired or not-yet-valid responder certificates were incorrectly accepted when verifying OCSP responses.
Own Id: OTP-20112
Related Id(s): PR-11136
Corrected basic constraint path validation check in accordance to RFC 5280.
Own Id: OTP-20129
Related Id(s): PR-11123, CVE-2026-42789
'public_key', Adhere to RFC 9525, and remove support for legacy fallback to check hostname against subject common name. Also improve error handling creating two separate errors for name constraint check for subject names and subject alternative names.
'ssl'. Error handling is slightly changed to better reflect public_key behaviour.
Own Id: OTP-20130
Related Id(s): PR-11124, CVE-2026-42790
*** POTENTIAL INCOMPATIBILITY ***
snmp-5.20.4
The snmp-5.20.4 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Fixed a bug in snmpm_usm:generate_outgoing_msg/5 that caused a badmatch crash when constructing an error response for an unknown user/engineID combination.
Own Id: OTP-20138
Related Id(s): ERIERL-1321, PR-11100
ssl-11.7.1
Note! The ssl-11.7.1 application cannot be applied independently of other applications on an arbitrary OTP 29 installation.
Fixed Bugs and Malfunctions
'public_key', Adhere to RFC 9525, and remove support for legacy fallback to check hostname against subject common name. Also improve error handling creating two separate errors for name constraint check for subject names and subject alternative names.
'ssl'. Error handling is slightly changed to better reflect public_key behaviour.
Own Id: OTP-20130
Related Id(s): PR-11124, CVE-2026-42790
*** POTENTIAL INCOMPATIBILITY ***
Could cause server to terminate a connection without an alert towards a bad client.
Own Id: OTP-20141
Related Id(s): PR-11125
Thanks to
Martin Hässler, Paul Guyot
v28.4.3: OTP 28.4.3Compare Source
Check out the git tag OTP-28.4.3, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.
OTP-28.4.3
Fixed Bugs and Malfunctions
Fix the
otp_patch_applyscript to properly handle installation of documentation for OTP versions with more than one digit in version parts less significant than the major version.Own Id: OTP-20086
Related Id(s): PR-10985
kernel-10.6.3
The kernel-10.6.3 application can be applied independently of other applications on a full OTP 28 installation.
Fixed Bugs and Malfunctions
On Windows, sockets has to be bound when using 'socket'. Therefor when using gen_tcp with inet_backend = socket, gen_tcp_socket bind even if the caller has not provided an explicit bind address. In that case it attempts to locate a "proper" address on its own. But if the connect address is the loopback address, this could lead to an attempt to bind to an external interface. So, this has now been changed so that if the connect address is the loopback address, the loopback address will also be used when binding.
Own Id: OTP-20104
Related Id(s): #10968
ssh-5.5.2
Note! The ssh-5.5.2 application cannot be applied independently of other applications on an arbitrary OTP 28 installation.
Fixed Bugs and Malfunctions
Fixed a vulnerability in the SFTP server where file attributes could be modified outside the configured root directory. When using FSETSTAT on an open file handle, the operation used the path stored in the handle without verifying it was within the root directory, allowing attribute changes to files outside the chroot boundary.
Thanks to John Downey.
Own Id: OTP-20081
Related Id(s): PR-11027, CVE-2026-32147
v28.4.2: OTP 28.4.2Compare Source
Check out the git tag OTP-28.4.2, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.
POTENTIAL INCOMPATIBILITIES
When OCSP stapling is enabled via the {stapling, staple} or {stapling, #{...}} options, the handshake now fails if the server does not provide an OCSP stapled response.
Previously, a missing OCSP staple was silently accepted (soft-fail). Since Erlang/OTP only supports OCSP via stapling with no fallback to direct OCSP queries or CRL checking, soft-fail meant no revocation check at all.
Applications that need the previous soft-fail behavior can use a custom verify_fun that accepts {bad_cert, missing_ocsp_staple}.
Own Id: OTP-20064
Application(s): ssl
Related Id(s): [PR-10941], [CVE-2026-32144]
compiler-9.0.6
The compiler-9.0.6 application can be applied independently of other applications on a full OTP 28 installation.
Fixed Bugs and Malfunctions
The type inference for
maps:from_list/1was incorrect: when the provided list was statically known to be bogus when non-empty (e.g. a list of atoms), the compiler assumed it would also fail when the list was empty.Own Id: OTP-19506
Related Id(s): [GH-9476], [PR-9481]
Fixed a bug in the type analysis pass that could erroneously eliminate code blocks.
Own Id: OTP-19931
Related Id(s): [GH-10562], [PR-10569]
A binary as the value of a
-moduledoc()attribute would be silently ignored.Own Id: OTP-20065
Related Id(s): [GH-10901], [PR-10904]
erts-16.3.1
The erts-16.3.1 application can be applied independently of other applications on a full OTP 28 installation.
Fixed Bugs and Malfunctions
Fixed a JIT bug that miscompiled expressions like
X * X + X * X.Own Id: OTP-19889
Related Id(s): [GH-10454], [PR-10456]
Fixed bug on windows that made tools dialyzer, erlc and typer unusable in powershell or cmd.exe, when there are spaces in the installation path.
Own Id: OTP-20027
Related Id(s): [PR-10620]
Fixed a bug with prim_tty that could occur on windows if we cannot get the console mode, mark the TTY as unavailable. This can happen when the input handle is a pipe, but the output handle is a console.
Own Id: OTP-20060
Related Id(s): [PR-10899]
eunit-2.10.3
The eunit-2.10.3 application can be applied independently of other applications on a full OTP 28 installation.
Fixed Bugs and Malfunctions
Fixed EUnit {node, ...} instantiation by passing node name (instead of pid) and restored net_kernel auto-start for non-distributed nodes.
Own Id: OTP-20047
Related Id(s): [PR-10788]
inets-9.6.2
The inets-9.6.2 application can be applied independently of other applications on a full OTP 28 installation.
Fixed Bugs and Malfunctions
Fixed authentication bypass in
httpdwhenscript_aliasmaps a URL to a directory outsidedocument_rootwithmod_authdirectory-based access controls. Themod_alias:which_alias/1function now includesscript_aliasentries so authorization is evaluated against the correct path before CGI execution. CVE-2026-28808.Own Id: OTP-20068
Improvements and New Features
Fixed typo in
http_server.mdguideOwn Id: OTP-20044
Related Id(s): [GH-10785], [PR-10867]
Expected error
accept_socket_timeoutin httpd_request_handler now exits gracefully, without generating a crash and supervisor reports.Own Id: OTP-20052
Related Id(s): ERIERL-1310, [PR-10893]
kernel-10.6.2
The kernel-10.6.2 application can be applied independently of other applications on a full OTP 28 installation.
Fixed Bugs and Malfunctions
Before this patch, the Erlang/OTP built-in DNS resolver (
inet_res) used a sequential, process-global 16-bit transaction ID for UDP queries and did not implement source port randomization. Response validation relied almost entirely on this ID. Together, this made DNS cache poisoning practical for an attacker who can observe one query or predict the next ID. The design conflicted with RFC 5452 recommendations for mitigating forged DNS answers.inet_resis intended for use in trusted network environments and with trusted recursive resolvers. Earlier documentation did not clearly state this deployment assumption, which could lead users to deploy the resolver in environments where faked DNS responses are possible.Therefore, the documentation is been updated to clarify that
inet_resshould only be used in trusted networks and with trusted recursive resolvers.The implementation is also improved to use strong random DNS transaction IDs and source ports for every DNS transaction. This should give ample protection against brute forcing fake DNS replies, known as DNS cache poisoning, but it still does not protect against, for example, an adversary in the path of the DNS transaction tha
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.