Erlang OTP: baixar versions anteriors

Patch Package: OTP 29.1.2
Git Tag: OTP-29.1.2
Date: 2026-10-14
Trouble Report Id: OTP-20359, OTP-20360, OTP-20385, OTP-20392,
OTP-20394, OTP-20408, OTP-20415, OTP-20418,
OTP-20420, OTP-20423, OTP-20426, OTP-20427,
OTP-20428, OTP-20437, OTP-20438, OTP-20439,
OTP-20440, OTP-20442, OTP-20444, OTP-20445,
OTP-20447, OTP-20456
Seq num: CVE-2026-105236, CVE-2026-42789,
CVE-2026-48856, CVE-2026-94200,
CVE-2026-96596, ERIERL-1362, ERIERL-1367,
GH-11620, GH-11691, GH-11702, GH-11709,
GH-11724, GH-11735, GH-11748, GH-11762,
GH-SA-m75x-4vwg-ggjh, GH-SA-q7cq-pfgf-5hr7,
OTP-20155, OTP-20346, PR-11474, PR-11561,
PR-11623, PR-11662, PR-11692, PR-11707,
PR-11708, PR-11719, PR-11720, PR-11727,
PR-11753, PR-11755, PR-11763, PR-11767,
PR-11768, PR-11773, PR-11791, PR-11808,
PR-11823, PR-11824, PR-11825
System: OTP
Release: 29
Application: compiler-10.0.7, dialyzer-6.0.4, erts-17.1.1,
inets-9.8.1, mnesia-4.27.1, odbc-2.17.2,
public_key-1.21.8, snmp-5.20.6, ssh-6.0.7,
ssl-11.7.8, stdlib-8.1.1
Predecessor: OTP 29.1.1
Check out the git tag OTP-29.1.2, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.
POTENTIAL INCOMPATIBILITIES
- When the max_channels limit is reached for a port-forwarding channel (direct-tcpip or forwarded-tcpip), the SSH daemon now refuses the individual channel with SSH_MSG_CHANNEL_OPEN_FAILURE and keeps the connection alive, instead of terminating the whole SSH connection. Port-forwarding channels now behave like session channels, which already survived the limit, and this matches OpenSSH. Applications that relied on the connection being closed when the channel limit was reached must instead handle the channel-open failure.
Own Id: OTP-20420
Application(s): ssh
Related Id(s): PR-11708

compiler-10.0.7
The compiler-10.0.7 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
Own Id: OTP-20415
Related Id(s): GH-11691, PR-11719
- Compilation of a function with thousands of clauses would be very slow.
Own Id: OTP-20437
Related Id(s): GH-11735, PR-11767
- Sometimes compiling with deterministic would not guarantee generation of identical BEAM files for every build.
Own Id: OTP-20438
Related Id(s): GH-11748, PR-11753
- A crash in sys_core_fold on native record patterns has been eliminated.
Own Id: OTP-20440
Related Id(s): GH-11724, PR-11768
> __KOMAC_HEADER__ Full runtime dependencies of compiler-10.0.7
>
> crypto-5.1, erts-13.0, kernel-8.4, stdlib-8.0

dialyzer-6.0.4
The dialyzer-6.0.4 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- Dialyzer will now avoid an infinite loop when multiple nominal types with the same structure are analyzed together.
Own Id: OTP-20444
Related Id(s): GH-11762, PR-11763
> __KOMAC_HEADER__ Full runtime dependencies of dialyzer-6.0.4
>
> compiler-10.0, erts-12.0, kernel-8.0, stdlib-5.0, syntax_tools-2.0

erts-17.1.1
The erts-17.1.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- Two trace sessions that trace garbage_collection on the same process crash the emulator on the first collection.
trace_gc() in erl_trace.c builds the GC info list on a temporary heap for the first session and frees it inside the session loop. The next session reuses msg, which now points into freed memory.
The memory is now freed after the session loop, which removes the use-after-free.
Own Id: OTP-20385
Related Id(s): PR-11623
Own Id: OTP-20415
Related Id(s): GH-11691, PR-11719
> __KOMAC_HEADER__ Full runtime dependencies of erts-17.1.1
>
> kernel-9.0, sasl-3.3, stdlib-4.1

inets-9.8.1
The inets-9.8.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and 

Patch Package: OTP 29.1.1
Git Tag: OTP-29.1.1
Date: 2026-09-22
Trouble Report Id: OTP-20272, OTP-20287, OTP-20355, OTP-20371,
OTP-20386, OTP-20388, OTP-20390, OTP-20393
Seq num: CVE-2026-65634, CVE-2026-68956,
CVE-2026-89422, ERIERL-1355, ERIERL-1363,
GH-11586, GH-11619, GH-SA-qhcm-px9c-rvfh,
PR-11523, PR-11559, PR-11616, PR-11630,
PR-11638, PR-11641, PR-11651, PR-11655
System: OTP
Release: 29
Application: asn1-5.5.2, compiler-10.0.6,
public_key-1.21.7, ssh-6.0.6, ssl-11.7.7
Predecessor: OTP 29.1
Check out the git tag OTP-29.1.1, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.
POTENTIAL INCOMPATIBILITIES
- Fixed a vulnerability where the max_channels daemon option was not enforced for session channels without an active subsystem, allowing a remote authenticated user to open an infinite number of channels and exhaust server resources despite the configured limit.
The default value of the max_channels daemon option has been changed from infinity to 256. Deployments requiring more than 256 simultaneous channels per connection can restore the previous behavior by setting {max_channels, infinity}.
The default value of the max_sessions daemon option has been changed from infinity to 1024. Deployments requiring more concurrent SSH connections can restore the previous behavior by setting {max_sessions, infinity}.
Own Id: OTP-20287
Application(s): ssh
Related Id(s): GH-SA-qhcm-px9c-rvfh, PR-11523, CVE-2026-68956

asn1-5.5.2
The asn1-5.5.2 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- Fixed a denial-of-service attack in asn1, where abnormally large OID components (arcs) could cause resource exhaustion.
Own Id: OTP-20272
Related Id(s): PR-11655, CVE-2026-65634
- The JER backend will no longer break certain values (true, false, null) when they are typed as ENUMERATED, they will now be encoded as strings as required by the standard.
Own Id: OTP-20355
Related Id(s): ERIERL-1355, PR-11559
> __KOMAC_HEADER__ Full runtime dependencies of asn1-5.5.2
>
> erts-14.0, kernel-9.0, stdlib-5.0

compiler-10.0.6
The compiler-10.0.6 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- Certain uses of funs could crash the compiler. For example:
f() ->
F = fun Fn(0) -> 0; Fn(N) -> Fn(N - 1) end,
[F(X) || X <- [1, 2]].
This has been corrected.
Own Id: OTP-20386
Related Id(s): GH-11619, PR-11638
> __KOMAC_HEADER__ Full runtime dependencies of compiler-10.0.6
>
> crypto-5.1, erts-13.0, kernel-8.4, stdlib-8.0

public_key-1.21.7
The public_key-1.21.7 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- Handle that policy qualifiers are optional.
Own Id: OTP-20393
Related Id(s): PR-11630
> __KOMAC_HEADER__ Full runtime dependencies of public_key-1.21.7
>
> asn1-5.0, crypto-5.8, erts-13.0, kernel-8.0, stdlib-4.0

ssh-6.0.6
The ssh-6.0.6 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- Fixed a vulnerability where the max_channels daemon option was not enforced for session channels without an active subsystem, allowing a remote authenticated user to open an infinite number of channels and exhaust server resources despite the configured limit.
The default value of the max_channels daemon option has been changed from infinity to 256. Deployments requiring more than 256 simultaneous channels per connection can restore the previous behavior by setting {max_channels, infinity}.
The default value of the max_sessions daemon option has been changed from infinity to 1024. Deployments requiring more concurrent SSH connections can restore the previous behavior by setting {ma

Patch Package: OTP 29.1
Git Tag: OTP-29.1
Date: 2026-09-16
Trouble Report Id: OTP-19631, OTP-20118, OTP-20131, OTP-20145,
OTP-20152, OTP-20158, OTP-20169, OTP-20175,
OTP-20177, OTP-20180, OTP-20187, OTP-20188,
OTP-20189, OTP-20209, OTP-20211, OTP-20213,
OTP-20218, OTP-20228, OTP-20235, OTP-20236,
OTP-20238, OTP-20246, OTP-20249, OTP-20254,
OTP-20255, OTP-20256, OTP-20262, OTP-20265,
OTP-20267, OTP-20276, OTP-20277, OTP-20280,
OTP-20290, OTP-20291, OTP-20292, OTP-20293,
OTP-20295, OTP-20297, OTP-20298, OTP-20303,
OTP-20304, OTP-20305, OTP-20309, OTP-20316,
OTP-20317, OTP-20318, OTP-20320, OTP-20322,
OTP-20326, OTP-20327, OTP-20328, OTP-20331,
OTP-20335, OTP-20338, OTP-20339, OTP-20352,
OTP-20354, OTP-20356, OTP-20358, OTP-20362,
OTP-20364, OTP-20365, OTP-20367, OTP-20373,
OTP-20374
Seq num: ERIERL-1356, GH-10879, GH-10968, GH-11093,
GH-11119, GH-11155, GH-11248, GH-11308,
GH-11338, GH-11344, GH-11349, GH-11351,
GH-11352, GH-11360, GH-11366, GH-11367,
GH-11397, GH-11398, GH-11401, GH-11406,
GH-11413, GH-11414, GH-11423, GH-11472,
GH-11534, GH-4417, GH-7862, GH-9302,
OTP-20102, PR-10297, PR-11074, PR-11096,
PR-11097, PR-11115, PR-11128, PR-11129,
PR-11130, PR-11133, PR-11137, PR-11144,
PR-11159, PR-11165, PR-11167, PR-11170,
PR-11196, PR-11203, PR-11216, PR-11226,
PR-11249, PR-11260, PR-11274, PR-11284,
PR-11300, PR-11313, PR-11316, PR-11324,
PR-11335, PR-11345, PR-11356, PR-11359,
PR-11361, PR-11363, PR-11375, PR-11376,
PR-11378, PR-11379, PR-11388, PR-11390,
PR-11391, PR-11396, PR-11410, PR-11422,
PR-11424, PR-11426, PR-11438, PR-11440,
PR-11442, PR-11444, PR-11446, PR-11447,
PR-11460, PR-11466, PR-11477, PR-11501,
PR-11505, PR-11507, PR-11530, PR-11552,
PR-11556, PR-11563, PR-11566, PR-11567,
PR-11570, PR-11574, PR-11600
System: OTP
Release: 29
Application: asn1-5.5.1, common_test-1.31.2,
compiler-10.0.5, crypto-5.10, dialyzer-6.0.3,
erts-17.1, inets-9.8, kernel-11.0.4,
mnesia-4.27, odbc-2.17.1, public_key-1.21.6,
runtime_tools-2.5, ssl-11.7.6, stdlib-8.1,
syntax_tools-4.1.1, tools-4.2.3, wx-2.7
Predecessor: OTP 29.0.6
Check out the git tag OTP-29.1, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.
POTENTIAL INCOMPATIBILITIES
- When beam_lib returns an error tuple, the filename in the information tuple is now a list of characters instead of an atom.
Example:
1> beam_lib:chunks(code:which(lists), ["nope"]).
{error,beam_lib,
{missing_chunk,".../git/otp/lib/stdlib/ebin/lists.beam",
"nope"}}
The reason for this change is that a long file name is not guaranteed to fit in an atom. Applications or tools that do deep inspection of the beam_lib errors (not recommended) will need to be updated.
Own Id: OTP-20118
Application(s): stdlib
Related Id(s): PR-11167

OTP-29.1

Improvements and New Features
- A new versions module has been added to the runtime_tools application containing functions for, e.g., comparing, versions that adhere to the OTP Versions Scheme.
The documentation of the OTP Versions Scheme has also been improved.
Own Id: OTP-20352
Related Id(s): PR-11556, PR-11600

asn1-5.5.1
The asn1-5.5.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- The modern representation of BITSTRINGs is now always supported for encoding, regardless of any legacy options given. The JER backend would not support the modern representation when any legacy option was given.
Own Id: OTP-20145
Related Id(s): PR-11097
- The make clean command did not remove all generated .erl files.
Own Id: OTP-20295
Related Id(s): PR-11375
> __KOMAC_HEADER__ Full runtime dependencies of asn1-5.5.1
>
> erts-14.0, kernel-9.0, stdlib-5.0

common_test-1.31.2
The common_test-1.31.2 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Ma

Patch Package: OTP 29.0.6
Git Tag: OTP-29.0.6
Date: 2026-09-01
Trouble Report Id: OTP-20135, OTP-20234, OTP-20264, OTP-20268,
OTP-20269, OTP-20270, OTP-20271, OTP-20274,
OTP-20278, OTP-20279, OTP-20281, OTP-20282,
OTP-20284, OTP-20286, OTP-20289, OTP-20296,
OTP-20300, OTP-20301, OTP-20302, OTP-20306,
OTP-20307, OTP-20308, OTP-20312, OTP-20319,
OTP-20321, OTP-20324, OTP-20330, OTP-20333,
OTP-20334, OTP-20342, OTP-20343, OTP-20344,
OTP-20345, OTP-20346, OTP-20347, OTP-20350,
OTP-20351
Seq num: CVE-2026-75538, ERIERL-1345, ERIERL-1354,
GH-11052, GH-11240, GH-11278, GH-11380,
GH-11404, GH-11416, GH-11419, GH-11494,
GH-11511, PR-11298, PR-11325, PR-11358,
PR-11417, PR-11425, PR-11428, PR-11429,
PR-11437, PR-11463, PR-11464, PR-11470,
PR-11478, PR-11481, PR-11485, PR-11492,
PR-11503, PR-11509, PR-11513, PR-11517,
PR-11521, PR-11533, PR-11538, PR-11539,
PR-11540, PR-11541, PR-11542, PR-11543,
PR-11544, PR-11545, PR-11546, PR-11547,
PR-11548, PR-11553, PR-11554
System: OTP
Release: 29
Application: compiler-10.0.4, crypto-5.9.3, eldap-1.3.1,
erl_interface-5.8.2, erts-17.0.6,
inets-9.7.2, megaco-4.9.2, mnesia-4.26.2,
public_key-1.21.5, snmp-5.20.5, ssh-6.0.5,
ssl-11.7.5, stdlib-8.0.4, tools-4.2.2
Predecessor: OTP 29.0.5
Check out the git tag OTP-29.0.6, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.
compiler-10.0.4
The compiler-10.0.4 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- compiler: Fix bug in beam_types:subtract/2 for bitstrings
Own Id: OTP-20312
Related Id(s): GH-11494, PR-11503
> __KOMAC_HEADER__ Full runtime dependencies of compiler-10.0.4
>
> crypto-5.1, erts-13.0, kernel-8.4, stdlib-8.0

crypto-5.9.3
The crypto-5.9.3 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- Fixed type mismatch between ErlNifUInt64 and uint64_t in crypto NIF that caused incompatible-pointer warnings on macOS arm64 when passing DH parameters to OpenSSL.
Own Id: OTP-20333
Related Id(s): GH-11511, PR-11513
> __KOMAC_HEADER__ Full runtime dependencies of crypto-5.9.3
>
> erts-9.0, kernel-6.0, stdlib-3.9

eldap-1.3.1
The eldap-1.3.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- eldap referral URL parsing now rejects a port component longer than 5 digits instead of attempting to convert an arbitrarily large digit string to an integer.
Own Id: OTP-20345
Related Id(s): PR-11538
> __KOMAC_HEADER__ Full runtime dependencies of eldap-1.3.1
>
> asn1-3.0, erts-6.0, kernel-3.0, ssl-5.3.4, stdlib-3.4

erl_interface-5.8.2
The erl_interface-5.8.2 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- erl_interface: Fix buffer leak and state corruption on ei_x_buff realloc failure
Own Id: OTP-20324
Related Id(s): PR-11492

erts-17.0.6
The erts-17.0.6 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- No-suspend port command signals (i.e. port command signals sent using the erlang:port_command/3 BIF or the erlang:send/3 BIF with the nosuspend option) were not aborted properly in all scenarios which could leave the port queue in a busy state indefinitely. Also asynchronously sent no-suspend command signals (i.e, port command signals sent using the erlang:send/3 BIF with the nosuspend option) could sometimes be delivered even though the port was busy.
Own Id: OTP-20135
Related Id(s): GH-11052, PR-11463
- erts: Fix missing exit_status caused by SIGCHLD race
Own Id: OTP-20274
Related Id(s): GH-11278, PR-11298
- erts: Fix bug in is_in_range instruction for x86 JIT
Own Id: OTP-20278
Related Id(s

Patch Package: OTP 29.0.5
Git Tag: OTP-29.0.5
Date: 2026-08-04
Trouble Report Id: OTP-20137, OTP-20275
Seq num: GH-11402, PR-11110, PR-11409
System: OTP
Release: 29
Application: erts-17.0.5, ssh-6.0.4
Predecessor: OTP 29.0.4
Check out the git tag OTP-29.0.5, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.
erts-17.0.5
The erts-17.0.5 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- Fixed a regression in the previous patch release that prevented epmd from binding to localhost.
Own Id: OTP-20275
Related Id(s): GH-11402, PR-11409
> __KOMAC_HEADER__ Full runtime dependencies of erts-17.0.5
>
> kernel-9.0, sasl-3.3, stdlib-4.1

ssh-6.0.4
The ssh-6.0.4 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- The SSH client and server now reject incoming packets not aligned to the cipher block size as required by RFC 4253 §6. For CBC ciphers, a timing-safe "packet discard" mechanism (CVE-2008-5161 mitigation) ensures structural errors are indistinguishable from MAC failures before disconnecting. AEAD and encrypt-then-MAC modes disconnect immediately.
Own Id: OTP-20137
Related Id(s): PR-11110
> __KOMAC_HEADER__ Full runtime dependencies of ssh-6.0.4
>
> crypto-5.7, erts-14.0, kernel-10.3, public_key-1.6.1, runtime_tools-1.15.1, stdlib-8.0

Patch Package: OTP 29.0.4
Git Tag: OTP-29.0.4
Date: 2026-07-27
Trouble Report Id: OTP-20136, OTP-20143, OTP-20214, OTP-20229,
OTP-20237, OTP-20239, OTP-20240, OTP-20241,
OTP-20242, OTP-20243, OTP-20244, OTP-20245,
OTP-20248, OTP-20250, OTP-20251, OTP-20257,
OTP-20258, OTP-20259, OTP-20260, OTP-20261
Seq num: CVE-2026-42792, CVE-2026-47078,
CVE-2026-54890, CVE-2026-55737,
CVE-2026-55953, CVE-2026-58227, ERIERL-1341,
GH-11319, GH-11332, GH-11368,
GH-SA-622p-qfh6-c352, GH-SA-7xgh-gmgf-q2g7,
PR-11239, PR-11297, PR-11303, PR-11323,
PR-11330, PR-11331, PR-11333, PR-11334,
PR-11336, PR-11337, PR-11341, PR-11343,
PR-11369, PR-11372, PR-11374, PR-11386,
PR-27944
System: OTP
Release: 29
Application: compiler-10.0.3, crypto-5.9.2,
diameter-2.7.2, erts-17.0.4, megaco-4.9.1,
public_key-1.21.4, ssh-6.0.3, ssl-11.7.4,
stdlib-8.0.3
Predecessor: OTP 29.0.3
Check out the git tag OTP-29.0.4, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.
POTENTIAL INCOMPATIBILITIES
- Mitigated a denial of service attack in epmd.
Thanks to Ryan Moore for finding and responsibly disclosing this vulnerability to the Erlang/OTP project.
Own Id: OTP-20136
Application(s): erts
Related Id(s): PR-11386, CVE-2026-42792

compiler-10.0.3
The compiler-10.0.3 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- compiler: Fix an internal consistency check failure with setelement
Own Id: OTP-20261
Related Id(s): GH-11368, PR-11374
> __KOMAC_HEADER__ Full runtime dependencies of compiler-10.0.3
>
> crypto-5.1, erts-13.0, kernel-8.4, stdlib-8.0

crypto-5.9.2
The crypto-5.9.2 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- Fixed crash in crypto:macN/5 when supplied MacLength was greater than length of what the underlying hash returned.
Own Id: OTP-20239
Related Id(s): PR-11239
- Fixed segfault in crypto:aead_cipher_init_nif when argument validation fails.
Own Id: OTP-20241
Related Id(s): PR-11330
- Fix cipher key buffer overread for chacha20_poly1305.
Own Id: OTP-20244
Related Id(s): PR-11337
> __KOMAC_HEADER__ Full runtime dependencies of crypto-5.9.2
>
> erts-9.0, kernel-6.0, stdlib-3.9

diameter-2.7.2
The diameter-2.7.2 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- Fix infinite loop in diameter_dist:route_session/2 when avp other than Session-Id has zero length.
Own Id: OTP-20242
Related Id(s): PR-11331
- Fix crash in diameter_dist:route_session/2 when Session-Id (code: 263) avp has zero length.
Own Id: OTP-20243
Related Id(s): PR-11333
> __KOMAC_HEADER__ Full runtime dependencies of diameter-2.7.2
>
> erts-10.0, kernel-3.2, ssl-9.0, stdlib-5.0

erts-17.0.4
The erts-17.0.4 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- Mitigated a denial of service attack in epmd.
Thanks to Ryan Moore for finding and responsibly disclosing this vulnerability to the Erlang/OTP project.
Own Id: OTP-20136
Related Id(s): PR-11386, CVE-2026-42792
*** POTENTIAL INCOMPATIBILITY ***
- Fixed heap corruption when an invalidly encoded tuple with an arity of 2^31 or larger is decoded from Erlang's External Term Format (binary_to_term).
Own Id: OTP-20214
Related Id(s): PR-11297, CVE-2026-55737
- When send_timeout is set and send_timeout_close is set to true, a 'tcp_closed' message is expected when the timeout occurs, but that (message) was not delivered. This has now been fixed.
Own Id: OTP-20257
Related Id(s): GH-11319
- A crafted External Term Format (ETF) payload could crash the runtime system.
Thanks to Paul Guyot for finding and responsibly disclosing this vulnerability to the Erlang/OTP proj

Patch Package: OTP 29.0.3
Git Tag: OTP-29.0.3
Date: 2026-07-02
Trouble Report Id: OTP-20173, OTP-20183, OTP-20185, OTP-20186,
OTP-20190, OTP-20191, OTP-20194, OTP-20196,
OTP-20197, OTP-20198, OTP-20199, OTP-20200,
OTP-20201, OTP-20206, OTP-20207, OTP-20208,
OTP-20215, OTP-20216, OTP-20217, OTP-20220,
OTP-20222, OTP-20226, OTP-20227, OTP-20230,
OTP-20231, OTP-20232, OTP-20233
Seq num: CVE-2026-53422, CVE-2026-54886,
CVE-2026-54887, CVE-2026-54891,
CVE-2026-55950, CVE-2026-55952, ERIERL-1333,
GH-SA-7wp4-pc27-2vj9, GH-SA-h9pw-h5w4-h976,
PR-11209, PR-11215, PR-11219, PR-11230,
PR-11239, PR-11244, PR-11247, PR-11250,
PR-11259, PR-11268, PR-11269, PR-11270,
PR-11271, PR-11281, PR-11282, PR-11283,
PR-11289, PR-11294, PR-11295, PR-11299,
PR-11302, PR-11306, PR-11307, PR-11309,
PR-11311
System: OTP
Release: 29
Application: common_test-1.31.1, compiler-10.0.2,
crypto-5.9.1, dialyzer-6.0.2, erts-17.0.3,
kernel-11.0.3, public_key-1.21.3, ssh-6.0.2,
ssl-11.7.3, stdlib-8.0.2
Predecessor: OTP 29.0.2
Check out the git tag OTP-29.0.3, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.
common_test-1.31.1
The common_test-1.31.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- Fixed a crash in ct_netconfc that occurred when the remote server closed the SSH connection during NETCONF subsystem negotiation.
Own Id: OTP-20191
Related Id(s): ERIERL-1333, PR-11230
> __KOMAC_HEADER__ Full runtime dependencies of common_test-1.31.1
>
> compiler-10.0, crypto-4.5, debugger-4.1, erts-7.0, ftp-1.0, inets-6.0, kernel-11.0, observer-2.1, runtime_tools-1.8.16, sasl-2.5, snmp-5.1.2, ssh-4.0, stdlib-8.0, syntax_tools-1.7, tools-3.2, xmerl-1.3.8

compiler-10.0.2
The compiler-10.0.2 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- Several compiler bugs that could crash the compiler or generate incorrect code in rare circumstances have been fixed.
Own Id: OTP-20222
Related Id(s): PR-11219
> __KOMAC_HEADER__ Full runtime dependencies of compiler-10.0.2
>
> crypto-5.1, erts-13.0, kernel-8.4, stdlib-8.0

crypto-5.9.1
The crypto-5.9.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- crypto:compute_key/4 for eddh and crypto:generate_key/2,3 for eddh/eddsa now raise an error:{notsup, Info, Description} exception instead of returning the atom notsup when the underlying cryptolib lacks support.
Own Id: OTP-20215
Related Id(s): PR-11302
> __KOMAC_HEADER__ Full runtime dependencies of crypto-5.9.1
>
> erts-9.0, kernel-6.0, stdlib-3.9

dialyzer-6.0.2
The dialyzer-6.0.2 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- Fix a bug with native record sets in erl_types.erl
Own Id: OTP-20201
> __KOMAC_HEADER__ Full runtime dependencies of dialyzer-6.0.2
>
> compiler-10.0, erts-12.0, kernel-8.0, stdlib-5.0, syntax_tools-2.0

erts-17.0.3
The erts-17.0.3 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- Fixed an undefined behavior in the internal erts_qsort() function, which could have been the cause of a beam crash seen when updating large maps.
Own Id: OTP-20185
Related Id(s): PR-11215
- Calculating bxor of the largest supported positive integer (erlang:system_info(max_integer)) and -1 would return [] instead of a raising a system_limit exception.
Own Id: OTP-20208
Related Id(s): PR-11269
- Fix possible race between ets:delete/1 and terminating process with a fixation on the same table.
Own Id: OTP-20217
Related Id(s): PR-11283
- A few code generation issues for the JIT on AArch64 (ARM64) have been fixed.
Fo

Patch Package: OTP 29.0.2
Git Tag: OTP-29.0.2
Date: 2026-06-10
Trouble Report Id: OTP-20057, OTP-20149, OTP-20150, OTP-20151,
OTP-20153, OTP-20154, OTP-20155, OTP-20156,
OTP-20160, OTP-20161, OTP-20162, OTP-20163,
OTP-20165, OTP-20166, OTP-20170, OTP-20172,
OTP-20174, OTP-20178, OTP-20181
Seq num: CVE-2026-48855, CVE-2026-48856,
CVE-2026-48858, CVE-2026-48859,
CVE-2026-48860, CVE-2026-49759,
CVE-2026-49760, GH-11104, GH-11105, GH-11152,
GH-SA-24cv-hwgr-37fq, GH-SA-3w6p-vwhf-wvp4,
GH-SA-6f4f-chj5-5g97, GH-SA-gp7x-mfv6-52cv,
GH-SA-m75x-4vwg-ggjh, GH-SA-pv7g-pjrq-x2fh,
GH-SA-xcxj-5pg2-v72j, PR-11141, PR-11145,
PR-11146, PR-11148, PR-11154, PR-11157,
PR-11168, PR-11181, PR-11186, PR-11192,
PR-11193, PR-11195, PR-11199, PR-11205,
PR-11212, PR-1234, PR-27384
System: OTP
Release: 29
Application: dialyzer-6.0.1, diameter-2.7.1,
erl_interface-5.8.1, erts-17.0.2, ftp-1.2.6,
inets-9.7.1, kernel-11.0.2, mnesia-4.26.1,
public_key-1.21.2, ssh-6.0.1, ssl-11.7.2,
stdlib-8.0.1, tools-4.2.1
Predecessor: OTP 29.0.1
Check out the git tag OTP-29.0.2, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.
dialyzer-6.0.1
The dialyzer-6.0.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- Fix native record bugs in Dialyzer
Own Id: OTP-20178
Related Id(s): PR-11199
> __KOMAC_HEADER__ Full runtime dependencies of dialyzer-6.0.1
>
> compiler-10.0, erts-12.0, kernel-8.0, stdlib-5.0, syntax_tools-2.0

diameter-2.7.1
The diameter-2.7.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- Fixed return value documentation of diameter:service_info(SvcName, statistics)
Own Id: OTP-20150
Related Id(s): GH-11105, PR-11146
> __KOMAC_HEADER__ Full runtime dependencies of diameter-2.7.1
>
> erts-10.0, kernel-3.2, ssl-9.0, stdlib-5.0

erl_interface-5.8.1
The erl_interface-5.8.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- Fixed stack overflow in ei_s_print_term for very big integer terms (> 2000 hexadecimal digits long).
Own Id: OTP-20160
Related Id(s): GH-SA-xcxj-5pg2-v72j, PR-11193, CVE-2026-49760

erts-17.0.2
The erts-17.0.2 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- A buffer overflow error when parsing SCTP ERROR or ABORT chunks has been fixed.
This could lead to stack corruption and VM crash, but ultimately with hard work by an attacker be refined into maybe even remote code execution.
Own Id: OTP-20165
Related Id(s): GH-SA-6f4f-chj5-5g97, PR-1234, CVE-2026-49759
> __KOMAC_HEADER__ Full runtime dependencies of erts-17.0.2
>
> kernel-9.0, sasl-3.3, stdlib-4.1

ftp-1.2.6
The ftp-1.2.6 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- FTP client default connections that use the so called passive mode of FTP fails to properly validating the response IP of the server, hence a malicious or compromised FTP server could redirect the data connection to an arbitrary host, enabling s server-side request forgery (SSRF) and FTP bounce attacks.
Own Id: OTP-20166
Related Id(s): GH-SA-24cv-hwgr-37fq, PR-11186, CVE-2026-48858
> __KOMAC_HEADER__ Full runtime dependencies of ftp-1.2.6
>
> erts-7.0, kernel-6.0, runtime_tools-1.15.1, ssl-10.2, stdlib-3.5

inets-9.7.1
The inets-9.7.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- The HTTP client (httpc) now removes Authorization, Proxy-Authorization, Cookie, Referer, and Origin headers when following a redirect to a different host or port. Previously these headers were forwarde

Patch Package: OTP 29.0.1
Git Tag: OTP-29.0.1
Date: 2026-05-27
Trouble Report Id: OTP-20112, OTP-20129, OTP-20130, OTP-20134,
OTP-20138, OTP-20139, OTP-20140, OTP-20141,
OTP-20146
Seq num: CVE-2026-42789, CVE-2026-42790, ERIERL-1321,
GH-11088, PR-11007, PR-11089, PR-11100,
PR-11107, PR-11123, PR-11124, PR-11125,
PR-11135, PR-11136
System: OTP
Release: 29
Application: compiler-10.0.1, erts-17.0.1, kernel-11.0.1,
public_key-1.21.1, snmp-5.20.4, ssl-11.7.1
Predecessor: OTP 29.0
Check out the git tag OTP-29.0.1, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.
POTENTIAL INCOMPATIBILITIES
- 'public_key', Adhere to RFC 9525, and remove support for legacy fallback to check hostname against subject common name. Also improve error handling creating two separate errors for name constraint check for subject names and subject alternative names.
'ssl'. Error handling is slightly changed to better reflect public_key behaviour.
Own Id: OTP-20130
Application(s): public_key, ssl
Related Id(s): PR-11124, CVE-2026-42790

compiler-10.0.1
The compiler-10.0.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- In rare circumstances, optimization of boolean expressions could invert the boolean value.
Own Id: OTP-20140
Related Id(s): GH-11088, PR-11089
- The compiler could crash when compiling code using native records in certain ways.
Own Id: OTP-20146
Related Id(s): PR-11135
> __KOMAC_HEADER__ Full runtime dependencies of compiler-10.0.1
>
> crypto-5.1, erts-13.0, kernel-8.4, stdlib-8.0

erts-17.0.1
The erts-17.0.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- Comparison of two native records could return an incorrect result or crash the runtime system.
Own Id: OTP-20139
Related Id(s): PR-11107
> __KOMAC_HEADER__ Full runtime dependencies of erts-17.0.1
>
> kernel-9.0, sasl-3.3, stdlib-4.1

kernel-11.0.1
The kernel-11.0.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- SCTP peeloff of an IPv6 socket, the peeled-off socket does not inherit the parent options as expected.
Own Id: OTP-20134
Related Id(s): PR-11007
> __KOMAC_HEADER__ Full runtime dependencies of kernel-11.0.1
>
> crypto-5.8, erts-17.0, sasl-3.0, stdlib-8.0

public_key-1.21.1
The public_key-1.21.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- OCSP responder certificates are now checked for expiration before being accepted as authorized responders. Previously, expired or not-yet-valid responder certificates were incorrectly accepted when verifying OCSP responses.
Own Id: OTP-20112
Related Id(s): PR-11136
- Corrected basic constraint path validation check in accordance to RFC 5280.
Own Id: OTP-20129
Related Id(s): PR-11123, CVE-2026-42789
- 'public_key', Adhere to RFC 9525, and remove support for legacy fallback to check hostname against subject common name. Also improve error handling creating two separate errors for name constraint check for subject names and subject alternative names.
'ssl'. Error handling is slightly changed to better reflect public_key behaviour.
Own Id: OTP-20130
Related Id(s): PR-11124, CVE-2026-42790
*** POTENTIAL INCOMPATIBILITY ***
> __KOMAC_HEADER__ Full runtime dependencies of public_key-1.21.1
>
> asn1-5.0, crypto-5.8, erts-13.0, kernel-8.0, stdlib-4.0

snmp-5.20.4
The snmp-5.20.4 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions
- Fixed a bug in snmpm_usm:generate_outgoing_msg/5 that caused a badmatch crash when constructing an error response for an unknown user/engineID combin

Inital Release: OTP 29.0
Git Tag: OTP-29.0
Date: 2026-05-13
Trouble Report Id: OTP-16607, OTP-19587, OTP-19611, OTP-19643,
OTP-19663, OTP-19672, OTP-19695, OTP-19708,
OTP-19709, OTP-19713, OTP-19734, OTP-19744,
OTP-19747, OTP-19750, OTP-19751, OTP-19763,
OTP-19766, OTP-19783, OTP-19784, OTP-19785,
OTP-19786, OTP-19793, OTP-19800, OTP-19801,
OTP-19807, OTP-19809, OTP-19811, OTP-19815,
OTP-19822, OTP-19826, OTP-19834, OTP-19838,
OTP-19842, OTP-19853, OTP-19858, OTP-19866,
OTP-19874, OTP-19882, OTP-19887, OTP-19898,
OTP-19903, OTP-19906, OTP-19910, OTP-19912,
OTP-19917, OTP-19918, OTP-19919, OTP-19921,
OTP-19922, OTP-19925, OTP-19927, OTP-19932,
OTP-19933, OTP-19934, OTP-19935, OTP-19936,
OTP-19938, OTP-19942, OTP-19943, OTP-19949,
OTP-19956, OTP-19960, OTP-19963, OTP-19964,
OTP-19965, OTP-19966, OTP-19968, OTP-19969,
OTP-19975, OTP-19980, OTP-19982, OTP-19991,
OTP-19995, OTP-19996, OTP-19997, OTP-20001,
OTP-20002, OTP-20003, OTP-20004, OTP-20010,
OTP-20013, OTP-20015, OTP-20016, OTP-20017,
OTP-20019, OTP-20020, OTP-20023, OTP-20025,
OTP-20026, OTP-20028, OTP-20029, OTP-20030,
OTP-20031, OTP-20032, OTP-20034, OTP-20035,
OTP-20036, OTP-20045, OTP-20048, OTP-20054,
OTP-20055, OTP-20059, OTP-20061, OTP-20066,
OTP-20069, OTP-20070, OTP-20071, OTP-20072,
OTP-20073, OTP-20076, OTP-20077, OTP-20078,
OTP-20079, OTP-20080, OTP-20085, OTP-20087,
OTP-20088, OTP-20090, OTP-20092, OTP-20095,
OTP-20099, OTP-20100, OTP-20102, OTP-20103,
OTP-20111, OTP-20114, OTP-20115, OTP-20116,
OTP-20117, OTP-20119, OTP-20123, OTP-20124,
OTP-20125, OTP-20126, OTP-20127, OTP-20128,
OTP-20132, OTP-20133
Seq num: ERIERL-1314, ERIERL-1315, ERIERL-1319,
GH-10071, GH-10125, GH-10151, GH-10214,
GH-10260, GH-10341, GH-10342, GH-10345,
GH-10557, GH-10650, GH-10807, GH-10968,
GH-11030, GH-8569, GH-8841, GH-8993, GH-9822,
OTP-16608, OTP-19652, OTP-19775, OTP-19779,
OTP-19827, OTP-20106, PR-10013, PR-10033,
PR-10078, PR-10114, PR-10115, PR-10126,
PR-10134, PR-10144, PR-10145, PR-10161,
PR-10166, PR-10168, PR-10187, PR-10189,
PR-10193, PR-10195, PR-10197, PR-10202,
PR-10207, PR-10230, PR-10234, PR-10243,
PR-10253, PR-10259, PR-10269, PR-10276,
PR-10277, PR-10281, PR-10304, PR-10338,
PR-10346, PR-10348, PR-10372, PR-10382,
PR-10387, PR-10417, PR-10421, PR-10422,
PR-10426, PR-10433, PR-10449, PR-10453,
PR-10478, PR-10510, PR-10511, PR-10514,
PR-10519, PR-10524, PR-10532, PR-10549,
PR-10554, PR-10556, PR-10564, PR-10568,
PR-10571, PR-10573, PR-10578, PR-10579,
PR-10580, PR-10585, PR-10592, PR-10598,
PR-10601, PR-10614, PR-10615, PR-10617,
PR-10619, PR-10626, PR-10642, PR-10646,
PR-10647, PR-10653, PR-10656, PR-10674,
PR-10710, PR-10718, PR-10730, PR-10735,
PR-10739, PR-10753, PR-10754, PR-10755,
PR-10770, PR-10782, PR-10783, PR-10801,
PR-10804, PR-10805, PR-10808, PR-10814,
PR-10817, PR-10818, PR-10819, PR-10820,
PR-10821, PR-10824, PR-10830, PR-10836,
PR-10838, PR-10839, PR-10870, PR-10892,
PR-10894, PR-10905, PR-10910, PR-10929,
PR-10938, PR-10948, PR-10949, PR-10950,
PR-10951, PR-10958, PR-10962, PR-10965,
PR-10969, PR-10970, PR-10979, PR-10986,
PR-10993, PR-10998, PR-11000, PR-11004,
PR-11010, PR-11012, PR-11019, PR-11025,
PR-11031, PR-11032, PR-11047, PR-11059,
PR-11062, PR-11067, PR-11069, PR-11073,
PR-11078, PR-11079, PR-11080, PR-7118,
PR-7315, PR-9115, PR-9125, PR-9134, PR-9153,
PR-9209, PR-9223, PR-9315, PR-9374, PR-9475,
PR-9712, PR-9814, PR-9864, PR-9866, PR-9894,
PR-9899, PR-9934, PR-9940, PR-9984
System: OTP
Release: 29
Application: asn1-5.5, common_test-1.31, compiler-10.0,
crypto-5.9, debugger-7.0, dialyzer-6.0,
diameter-2.7, edoc-1.5, eldap-1.3,
erl_interface-5.8, erts-17.0, et-1.8,
eunit-2.11, ftp-1.2.5, inets-9.7,
jinterface-1.16, kernel-11.0, megaco-4.9,
mnesia-4.26, observer-2.19, odbc-2.17,
os_mon-2.12, parsetools-2.8, public_key-1.21,
reltool-1.1, runtime_tools-2.4, sasl-4.4,
snmp-5.20.3, ssh-6.0, ssl-11.7, stdlib-8.0,
syntax_tools-4.1, tftp-1.3, tools-4.2,
wx-2.6, xmerl-2.2
Predecessor: OTP
Check out the git tag OTP-29.0, and build a full OTP system i

Patch Package: OTP 28.5.0.6
Git Tag: OTP-28.5.0.6
Date: 2026-09-01
Trouble Report Id: OTP-20135, OTP-20234, OTP-20264, OTP-20265,
OTP-20268, OTP-20269, OTP-20270, OTP-20271,
OTP-20274, OTP-20278, OTP-20279, OTP-20281,
OTP-20282, OTP-20284, OTP-20286, OTP-20289,
OTP-20296, OTP-20300, OTP-20302, OTP-20306,
OTP-20307, OTP-20308, OTP-20312, OTP-20319,
OTP-20320, OTP-20324, OTP-20330, OTP-20333,
OTP-20334, OTP-20342, OTP-20343, OTP-20344,
OTP-20345, OTP-20346, OTP-20347, OTP-20350,
OTP-20351
Seq num: CVE-2026-75538, ERIERL-1354, GH-11052,
GH-11278, GH-11308, GH-11380, GH-11404,
GH-11416, GH-11419, GH-11423, GH-11494,
GH-11511, PR-11298, PR-11325, PR-11388,
PR-11417, PR-11425, PR-11428, PR-11429,
PR-11437, PR-11463, PR-11464, PR-11478,
PR-11481, PR-11485, PR-11492, PR-11503,
PR-11505, PR-11509, PR-11513, PR-11517,
PR-11521, PR-11533, PR-11538, PR-11539,
PR-11540, PR-11541, PR-11542, PR-11543,
PR-11544, PR-11545, PR-11546, PR-11547,
PR-11548, PR-11553, PR-11554
System: OTP
Release: 28
Application: compiler-9.0.6.2, crypto-5.8.3.3,
eldap-1.2.16.1, erl_interface-5.7.0.2,
erts-16.4.0.6, inets-9.6.2.3,
kernel-10.6.3.4, megaco-4.8.3.2,
mnesia-4.25.3.2, snmp-5.20.2.2, ssh-5.5.2.5,
ssl-11.6.0.5, stdlib-7.3.0.2, tools-4.1.4.1
Predecessor: OTP 28.5.0.5
Check out the git tag OTP-28.5.0.6, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.
compiler-9.0.6.2
The compiler-9.0.6.2 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions
- compiler: Fix bug in beam_types:subtract/2 for bitstrings
Own Id: OTP-20312
Related Id(s): GH-11494, PR-11503
> __KOMAC_HEADER__ Full runtime dependencies of compiler-9.0.6.2
>
> crypto-5.1, erts-13.0, kernel-8.4, stdlib-6.0

crypto-5.8.3.3
The crypto-5.8.3.3 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions
- Fixed type mismatch between ErlNifUInt64 and uint64_t in crypto NIF that caused incompatible-pointer warnings on macOS arm64 when passing DH parameters to OpenSSL.
Own Id: OTP-20333
Related Id(s): GH-11511, PR-11513
> __KOMAC_HEADER__ Full runtime dependencies of crypto-5.8.3.3
>
> erts-9.0, kernel-6.0, stdlib-3.9

eldap-1.2.16.1
The eldap-1.2.16.1 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions
- eldap referral URL parsing now rejects a port component longer than 5 digits instead of attempting to convert an arbitrarily large digit string to an integer.
Own Id: OTP-20345
Related Id(s): PR-11538
> __KOMAC_HEADER__ Full runtime dependencies of eldap-1.2.16.1
>
> asn1-3.0, erts-6.0, kernel-3.0, ssl-5.3.4, stdlib-3.4

erl_interface-5.7.0.2
The erl_interface-5.7.0.2 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions
- erl_interface: Fix buffer leak and state corruption on ei_x_buff realloc failure
Own Id: OTP-20324
Related Id(s): PR-11492

erts-16.4.0.6
The erts-16.4.0.6 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions
- No-suspend port command signals (i.e. port command signals sent using the erlang:port_command/3 BIF or the erlang:send/3 BIF with the nosuspend option) were not aborted properly in all scenarios which could leave the port queue in a busy state indefinitely. Also asynchronously sent no-suspend command signals (i.e, port command signals sent using the erlang:send/3 BIF with the nosuspend option) could sometimes be delivered even though the port was busy.
Own Id: OTP-20135
Related Id(s): GH-11052, PR-11463
- erts: Fix missing exit_status caused by SIGCHLD race
Own Id: OTP-20274
Related Id(s): GH-11278, PR-11298
- erts: Fix bug in is_in_range

Patch Package: OTP 28.5.0.5
Git Tag: OTP-28.5.0.5
Date: 2026-08-04
Trouble Report Id: OTP-20137, OTP-20275
Seq num: GH-11402, PR-11110, PR-11409
System: OTP
Release: 28
Application: erts-16.4.0.5, ssh-5.5.2.4
Predecessor: OTP 28.5.0.4
Check out the git tag OTP-28.5.0.5, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.
erts-16.4.0.5
The erts-16.4.0.5 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions
- Fixed a regression in the previous patch release that prevented epmd from binding to localhost.
Own Id: OTP-20275
Related Id(s): GH-11402, PR-11409
> __KOMAC_HEADER__ Full runtime dependencies of erts-16.4.0.5
>
> kernel-9.0, sasl-3.3, stdlib-4.1

ssh-5.5.2.4
Note! The ssh-5.5.2.4 application cannot be applied independently of other applications on an arbitrary OTP 28 installation.
On a full OTP 28 installation, also the following runtime
dependency has to be satisfied:
-- crypto-5.7 (first satisfied in OTP 28.1)

Fixed Bugs and Malfunctions
- The SSH client and server now reject incoming packets not aligned to the cipher block size as required by RFC 4253 §6. For CBC ciphers, a timing-safe "packet discard" mechanism (CVE-2008-5161 mitigation) ensures structural errors are indistinguishable from MAC failures before disconnecting. AEAD and encrypt-then-MAC modes disconnect immediately.
Own Id: OTP-20137
Related Id(s): PR-11110
> __KOMAC_HEADER__ Full runtime dependencies of ssh-5.5.2.4
>
> crypto-5.7, erts-14.0, kernel-10.3, public_key-1.6.1, runtime_tools-1.15.1, stdlib-5.0, stdlib-6.0

Patch Package: OTP 28.5.0.3
Git Tag: OTP-28.5.0.3
Date: 2026-07-02
Trouble Report Id: OTP-20173, OTP-20183, OTP-20185, OTP-20186,
OTP-20190, OTP-20191, OTP-20194, OTP-20196,
OTP-20197, OTP-20199, OTP-20200, OTP-20206,
OTP-20207, OTP-20208, OTP-20211, OTP-20215,
OTP-20216, OTP-20217, OTP-20220, OTP-20226,
OTP-20230, OTP-20231, OTP-20232
Seq num: CVE-2026-53422, CVE-2026-54886,
CVE-2026-54887, CVE-2026-54891,
CVE-2026-55950, CVE-2026-55952, ERIERL-1333,
GH-SA-7wp4-pc27-2vj9, GH-SA-h9pw-h5w4-h976,
PR-11209, PR-11215, PR-11230, PR-11239,
PR-11247, PR-11250, PR-11259, PR-11268,
PR-11269, PR-11270, PR-11271, PR-11274,
PR-11282, PR-11283, PR-11294, PR-11295,
PR-11299, PR-11302, PR-11306, PR-11307,
PR-11309, PR-11311
System: OTP
Release: 28
Application: common_test-1.30.0.1, crypto-5.8.3.1,
erts-16.4.0.3, kernel-10.6.3.3,
public_key-1.20.3.3, ssh-5.5.2.2,
ssl-11.6.0.3
Predecessor: OTP 28.5.0.2
Check out the git tag OTP-28.5.0.3, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.
common_test-1.30.0.1
The common_test-1.30.0.1 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions
- Fixed a crash in ct_netconfc that occurred when the remote server closed the SSH connection during NETCONF subsystem negotiation.
Own Id: OTP-20191
Related Id(s): ERIERL-1333, PR-11230
> __KOMAC_HEADER__ Full runtime dependencies of common_test-1.30.0.1
>
> compiler-6.0, crypto-4.5, debugger-4.1, erts-7.0, ftp-1.0, inets-6.0, kernel-8.4, observer-2.1, runtime_tools-1.8.16, sasl-2.5, snmp-5.1.2, ssh-4.0, stdlib-4.0, syntax_tools-1.7, tools-3.2, xmerl-1.3.8

crypto-5.8.3.1
The crypto-5.8.3.1 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions
- crypto:compute_key/4 for eddh and crypto:generate_key/2,3 for eddh/eddsa now raise an error:{notsup, Info, Description} exception instead of returning the atom notsup when the underlying cryptolib lacks support.
Own Id: OTP-20215
Related Id(s): PR-11302
> __KOMAC_HEADER__ Full runtime dependencies of crypto-5.8.3.1
>
> erts-9.0, kernel-6.0, stdlib-3.9

erts-16.4.0.3
The erts-16.4.0.3 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions
- Fixed an undefined behavior in the internal erts_qsort() function, which could have been the cause of a beam crash seen when updating large maps.
Own Id: OTP-20185
Related Id(s): PR-11215
- Calculating bxor of the largest supported positive integer (erlang:system_info(max_integer)) and -1 would return [] instead of a raising a system_limit exception.
Own Id: OTP-20208
Related Id(s): PR-11269
- Fix possible race between ets:delete/1 and terminating process with a fixation on the same table.
Own Id: OTP-20217
Related Id(s): PR-11283
- A few code generation issues for the JIT on AArch64 (ARM64) have been fixed.
For all platforms, the loader will reject some invalid BEAM files earlier.
Own Id: OTP-20226
Related Id(s): PR-11299

Improvements and New Features
- Arithmetic operations on large integers will now increase the reduction count for the process, causing context switches to occur more frequently when doing arithmetic on large integers.
Own Id: OTP-20211
Related Id(s): PR-11274
> __KOMAC_HEADER__ Full runtime dependencies of erts-16.4.0.3
>
> kernel-9.0, sasl-3.3, stdlib-4.1

kernel-10.6.3.3
The kernel-10.6.3.3 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions
- inet:info/1 could crash when calling for a closing (port) socket.
Own Id: OTP-20173
- Handling of the truncation bit in inet_res has been fixed so it properly falls back to querying over TCP after a truncated UDP reply.
This fixes a bug introduced

Patch Package: OTP 28.5.0.1
Git Tag: OTP-28.5.0.1
Date: 2026-05-27
Trouble Report Id: OTP-20112, OTP-20116, OTP-20119, OTP-20123,
OTP-20126, OTP-20128, OTP-20129, OTP-20130,
OTP-20131, OTP-20134, OTP-20138, OTP-20140,
OTP-20141
Seq num: CVE-2026-42789, CVE-2026-42790, ERIERL-1314,
ERIERL-1315, ERIERL-1321, GH-10968, GH-11030,
GH-11088, OTP-20102, PR-11007, PR-11032,
PR-11062, PR-11067, PR-11079, PR-11089,
PR-11100, PR-11123, PR-11124, PR-11125,
PR-11136
System: OTP
Release: 28
Application: compiler-9.0.6.1, erts-16.4.0.1,
inets-9.6.2.1, kernel-10.6.3.1,
public_key-1.20.3.1, snmp-5.20.2.1,
ssl-11.6.0.1, wx-2.5.4.1
Predecessor: OTP 28.5
Check out the git tag OTP-28.5.0.1, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.
POTENTIAL INCOMPATIBILITIES
- 'public_key', Adhere to RFC 9525, and remove support for legacy fallback to check hostname against subject common name. Also improve error handling creating two separate errors for name constraint check for subject names and subject alternative names.
'ssl'. Error handling is slightly changed to better reflect public_key behaviour.
Own Id: OTP-20130
Application(s): public_key, ssl
Related Id(s): PR-11124, CVE-2026-42790

compiler-9.0.6.1
The compiler-9.0.6.1 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions
- In rare circumstances, optimization of boolean expressions could invert the boolean value.
Own Id: OTP-20140
Related Id(s): GH-11088, PR-11089
> __KOMAC_HEADER__ Full runtime dependencies of compiler-9.0.6.1
>
> crypto-5.1, erts-13.0, kernel-8.4, stdlib-6.0

erts-16.4.0.1
The erts-16.4.0.1 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions
- Fixed erlang:md5_init to always return the same deterministic context binary. Only an issue in OTP 28.5 when OTP was built with --disable-builtin-openssl or --enable-use-embedded-3pp-alternatives.
Own Id: OTP-20123
- Added explicit configure test for C++ function std::to_chars if options --disable-builtin-ryu or --enable-use-embedded-3pp-alternatives is used.
Own Id: OTP-20126
Related Id(s): PR-11067
> __KOMAC_HEADER__ Full runtime dependencies of erts-16.4.0.1
>
> kernel-9.0, sasl-3.3, stdlib-4.1

inets-9.6.2.1
The inets-9.6.2.1 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions
- A call to httpd:reload_config/2 now validates the new configuration before removing the old one, leaving the server running in case of faulty config, instead of putting it in an unrecoverable state.
Own Id: OTP-20128
Related Id(s): ERIERL-1314, PR-11079
> __KOMAC_HEADER__ Full runtime dependencies of inets-9.6.2.1
>
> erts-14.0, kernel-9.0, mnesia-4.12, public_key-1.13, runtime_tools-1.8.14, ssl-9.0, stdlib-5.0, stdlib-6.0

kernel-10.6.3.1
The kernel-10.6.3.1 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions
- Incorrect TOS format when using gen_udp with socket backend
Own Id: OTP-20131
Related Id(s): GH-10968, OTP-20102
- SCTP peeloff of an IPv6 socket, the peeled-off socket does not inherit the parent options as expected.
Own Id: OTP-20134
Related Id(s): PR-11007
> __KOMAC_HEADER__ Full runtime dependencies of kernel-10.6.3.1
>
> crypto-5.0, erts-15.2.5, sasl-3.0, stdlib-7.0

public_key-1.20.3.1
Note! The public_key-1.20.3.1 application cannot be applied independently of other applications on an arbitrary OTP 28 installation.
On a full OTP 28 installation, also the following runtime
dependency has to be satisfied:
-- crypto-5.8 (first satisfied in OTP 28.3)

Fixed Bugs and Malfunctions
- OCSP responder certificates are now checked for expiration before being accepted as 

Erlang/OTP 27 Released
All artifacts for the release can be downloaded from the Erlang/OTP Github release and you can view the new documentation at https://erlang.org/doc.You can also install the latest release using kerl like this:

kerl build 27.0 27.0

The new Erlang/OTP 27 release contains new features, improvements as well as a few incompatibilities. Some of the new features are highlighted below.Many thanks to all contributors!Documentation
EEP-59 has been implemented. Documentation attributes in source files can now be used to document functions, types, callbacks, and modules.The entire Erlang/OTP documentation is now using the new documentation system.New language features
- Triple-Quoted Strings has been implemented as per EEP 64 to allow a string to encompass a complete paragraph.
- Adjacent string literals without intervening white space is now a syntax error, to avoid possible confusion with triple-quoted strings.
- Sigils on string literals (both ordinary and triple-quoted) have been implemented as per EEP 66. For example, ~"Björn" or ~b"Björn" are now equivalent to <<"Björn"/utf8>>.
Compiler and JIT improvements
- The compiler will now merge consecutive updates of the same record.
- Safe destructive update of tuples has been implemented in the compiler and runtime system. This allows the VM to update tuples in-place when it is safe to do so, thus improving performance by doing less copying but also by producing less garbage.
- The maybe expression is now enabled by default, eliminating the need for enabling the maybe_expr feature.
- Native coverage support has been implemented in the JIT. It will automatically be used by the cover tool to reduce the execution overhead when running cover-compiled code. There are also new APIs to support native coverage without using the cover tool.
- The compiler will now raise a warning when updating record/map literals to catch a common mistake. For example, the compiler will now emit a warning for #r{a=1}#r{b=2}.
- The order in which the compiler looks up options has changed.When there is a conflict in the compiler options given in the -compile() attribute and options given to the compiler, the options given in the -compile() attribute overrides the option given to the compiler, which in turn overrides options given in the ERL_COMPILER_OPTIONS environment variable.Example:If some_module.erl has the following attribute:

-compile([nowarn_missing_spec]).

and the compiler is invoked like so:

% erlc +warn_missing_spec some_module.erl

no warnings will be issued for functions that do not have any specs.
ERTS
- The erl command now supports the -S flag, which is similar to the -run flag, but with some of the rough edges filed off.
- By default, escripts will now be compiled instead of interpreted. That means that the compiler application must be installed.
- The existing experimental support for archive files will be changed in a future release. The support for having an archive in an escript will remain, but the support for using archives in a release will either become more limited or completely removed.As of Erlang/OTP 27, the function code:lib_dir/2, the -code_path_choice flag, and using erl_prim_loader for reading members of an archive are deprecated.To remain compatible with future version of Erlang/OTP escript scripts that need to retrieve data files from its archive should use escript:extract/2 instead of erl_prim_loader and code:lib_dir/2.
- The default process limit has been raised to 1048576 processes.
- The erlang:system_monitor/2 functionality is now able to monitor long message queues in the system.
- The obsolete and undocumented support for opening a port to an external resource by passing an atom (or a string) as first argument to open_port(), implemented by the vanilla driver, has been removed. This feature has been scheduled for removal in OTP 27 since the release of OTP 26.
- The pid field has been removed from erlang:fun_info/1,2.
- Multiple trace sessions are n