From otp@REDACTED Tue Sep 1 14:08:39 2026 From: otp@REDACTED (Erlang/OTP) Date: Tue, 01 Sep 2026 14:08:39 +0200 (CEST) Subject: Patch Package OTP 29.0.6 Released Message-ID: <20260901120839.7FB472C538@hel.cslab.ericsson.net> Patch Package: OTP 29.0.6 Git Tag: OTP-29.0.6 Date: 2026-09-01 Trouble Report Id: OTP-20135, OTP-20234, OTP-20264, OTP-20268, OTP-20269, OTP-20270, OTP-20271, OTP-20274, OTP-20278, OTP-20279, OTP-20281, OTP-20282, OTP-20284, OTP-20286, OTP-20289, OTP-20296, OTP-20300, OTP-20301, OTP-20302, OTP-20306, OTP-20307, OTP-20308, OTP-20312, OTP-20319, OTP-20321, OTP-20324, OTP-20330, OTP-20333, OTP-20334, OTP-20342, OTP-20343, OTP-20344, OTP-20345, OTP-20346, OTP-20347, OTP-20350, OTP-20351 Seq num: CVE-2026-75538, ERIERL-1345, ERIERL-1354, GH-11052, GH-11240, GH-11278, GH-11380, GH-11404, GH-11416, GH-11419, GH-11494, GH-11511, PR-11298, PR-11325, PR-11358, PR-11417, PR-11425, PR-11428, PR-11429, PR-11437, PR-11463, PR-11464, PR-11470, PR-11478, PR-11481, PR-11485, PR-11492, PR-11503, PR-11509, PR-11513, PR-11517, PR-11521, PR-11533, PR-11538, PR-11539, PR-11540, PR-11541, PR-11542, PR-11543, PR-11544, PR-11545, PR-11546, PR-11547, PR-11548, PR-11553, PR-11554 System: OTP Release: 29 Application: compiler-10.0.4, crypto-5.9.3, eldap-1.3.1, erl_interface-5.8.2, erts-17.0.6, inets-9.7.2, megaco-4.9.2, mnesia-4.26.2, public_key-1.21.5, snmp-5.20.5, ssh-6.0.5, ssl-11.7.5, stdlib-8.0.4, tools-4.2.2 Predecessor: OTP 29.0.5 Check out the git tag OTP-29.0.6, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below. # compiler-10.0.4 The compiler-10.0.4 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - compiler: Fix bug in beam_types:subtract/2 for bitstrings Own Id: OTP-20312 Related Id(s): GH-11494, PR-11503 > #### Full runtime dependencies of compiler-10.0.4 > > crypto-5.1, erts-13.0, kernel-8.4, stdlib-8.0 # crypto-5.9.3 The crypto-5.9.3 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - Fixed type mismatch between `ErlNifUInt64` and `uint64_t` in crypto NIF that caused incompatible-pointer warnings on macOS arm64 when passing DH parameters to OpenSSL. Own Id: OTP-20333 Related Id(s): GH-11511, PR-11513 > #### Full runtime dependencies of crypto-5.9.3 > > erts-9.0, kernel-6.0, stdlib-3.9 # eldap-1.3.1 The eldap-1.3.1 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - eldap referral URL parsing now rejects a port component longer than 5 digits instead of attempting to convert an arbitrarily large digit string to an integer. Own Id: OTP-20345 Related Id(s): PR-11538 > #### Full runtime dependencies of eldap-1.3.1 > > asn1-3.0, erts-6.0, kernel-3.0, ssl-5.3.4, stdlib-3.4 # erl_interface-5.8.2 The erl_interface-5.8.2 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - erl_interface: Fix buffer leak and state corruption on `ei_x_buff` realloc failure Own Id: OTP-20324 Related Id(s): PR-11492 # erts-17.0.6 The erts-17.0.6 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - No-suspend port command signals (i.e. port command signals sent using the erlang:port_command/3 BIF or the erlang:send/3 BIF with the `nosuspend` option) were not aborted properly in all scenarios which could leave the port queue in a busy state indefinitely. Also asynchronously sent no-suspend command signals (i.e, port command signals sent using the erlang:send/3 BIF with the `nosuspend` option) could sometimes be delivered even though the port was busy. Own Id: OTP-20135 Related Id(s): GH-11052, PR-11463 - erts: Fix missing exit_status caused by SIGCHLD race Own Id: OTP-20274 Related Id(s): GH-11278, PR-11298 - erts: Fix bug in `is_in_range` instruction for x86 JIT Own Id: OTP-20278 Related Id(s): GH-11419, PR-11429 - Fixed bug in `binary_to_term` that could cause emulator crash for specific terms in specific process states (reductions left). Own Id: OTP-20281 Related Id(s): GH-11404, PR-11425 - erts: Fix crash with `term_to_iovec/2` for large binary Own Id: OTP-20282 Related Id(s): PR-11428 - A distributed `priority` send larger than 32 KiB to a process alias caused the receiving runtime system to crash. Own Id: OTP-20286 Related Id(s): GH-11416, PR-11417 - Priority message queue markers were sometimes installed in the message queue even when no priority messages could be received. As a result, the two markers had to be traversed unnecessarily when scanning the message queue, introducing a small but avoidable overhead. Own Id: OTP-20300 Related Id(s): PR-11485 - A monitor of `time_offset` co-created with a process alias (`monitor(time_offset, clock_service, {alias, UnaliasOpt})`) either crashed the runtime system or did not work. This bug was introduced in OTP 25.0. Own Id: OTP-20319 Related Id(s): PR-11509 - A process alias was erroneously created when a remote `spawn_request()` operation with a `{monitor, {alias, explicit_unalias}}` option failed with `noconnection` reason. Own Id: OTP-20330 Related Id(s): PR-11521 - A `gen_tcp` socket using the inet driver and `{packet,4}` had a bug if receiving a packet with size just below INT_MAX. That packet size wrapped in size calculations and made the received data overwrite its allocation and trash allocator metadata and subsequent block(s), causing the VM to crash. This made it possible for anyone to remotely crash an Erlang node that used `{packet,4}` on a reachable socket. This bug has been corrected. Own Id: OTP-20334 Related Id(s): PR-11533, CVE-2026-75538 > #### Full runtime dependencies of erts-17.0.6 > > kernel-9.0, sasl-3.3, stdlib-4.1 # inets-9.7.2 The inets-9.7.2 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - The `dets` and `mnesia` `mod_auth` backends used a key that did not include the directory path, so all `require_user`/`require_group` records collapsed into one per-listener namespace. A user authorized for one protected directory could authenticate against any other protected directory served by the same listener. `{path, Directory}` is now included in the auth backend key, scoping records per directory as documented. Own Id: OTP-20264 Related Id(s): PR-11546 - Requests specifying both `Transfer-Encoding` and `Content-Length` headers are now rejected with `400 Bad Request`, per RFC 9112 Section 6.3. Previously such requests could be used for CL.TE request-smuggling/desync attacks against reverse proxies in front of `httpd`. Own Id: OTP-20268 Related Id(s): PR-11547 - `httpd` accepted the obsolete header line-folding syntax (RFC 9112 Section 5.2, a continuation line beginning with space/tab), silently treating the folded continuation as a separate header. This allowed CL.TE-style request smuggling when `httpd` was placed behind a folding-aware proxy. Such requests are now rejected with `400 Bad Request`. Own Id: OTP-20269 Related Id(s): PR-11544 - A header such as `Content-Length : 6` (whitespace before the colon) was previously silently dropped, causing the content length to default to 0 and the body bytes to be misinterpreted as a pipelined request (CL.0 smuggling). Per RFC 7230 Section 3.2.4, such headers are now rejected with `400 Bad Request`. Own Id: OTP-20270 Related Id(s): PR-11545 - A new httpd option `request_timeout` (default 60 seconds, renamed from the interim `max_body_read_timeout`) bounds the idle time between reads of a request body/message. The server now also sends `408 Request Timeout` when the `min_bytes_per_second` floor is hit, and `keep_alive_timeout` measurement was corrected so the timer is cancelled as soon as new data arrives rather than only after full header parsing; `keep_alive_timeout` and `request_timeout` now also accept `infinity` to disable the timeout. Own Id: OTP-20271 Related Id(s): PR-11543 - `mod_auth`, `mod_security`, and `mod_get` compared resolved filesystem paths against configured protected-directory patterns without normalizing repeated slashes or filesystem case. On case-insensitive filesystems (macOS, Windows) or with repeated slashes, a request could resolve to a protected resource while evading the directory match. Paths are now canonicalized (slash-collapsed, and case-normalized when the filesystem is case-insensitive) before the authorization decision. Own Id: OTP-20279 Related Id(s): PR-11542 - A request with an invalid chunked transfer-encoding chunk size previously caused the httpd connection handler to hang indefinitely without requiring further input from the client. This leaked a process per request and could be used to exhaust server resources (denial of service). Invalid chunk sizes are now rejected immediately with an error response, and the connection is closed. Own Id: OTP-20306 Related Id(s): PR-11539 - `max_body_size` was previously enforced only after a complete chunk had been received, allowing a single oversized chunk to be buffered in full before the limit was checked ??? undermining the memory-exhaustion protection the option is meant to provide. The limit is now enforced incrementally as chunk data arrives, rejecting the request as soon as the configured size is exceeded. Own Id: OTP-20307 Related Id(s): PR-11540 - The documented default of 150 for the `max_clients` option was not applied by the implementation, allowing an unbounded number of concurrent clients to connect regardless of configuration. The default is now correctly enforced. Own Id: OTP-20308 Related Id(s): PR-11541 - Fixed a bug where httpd failed to start when configured with {socket_type, {ip_comm, SockOpts}} and a fixed (non-zero) port. Own Id: OTP-20342 Related Id(s): PR-11548 - `httpc` now enforces a limit on the total size of response headers and response body, preventing unbounded memory allocation when connecting to a malicious or malfunctioning server. The new max_header_size and max_body_size request options can be used to override the default limit (10240 bytes for headers). Additionally, httpc now validates that the Content-Length header contains only digits before use, avoiding a crash on malformed responses. Own Id: OTP-20343 Related Id(s): PR-11538 > #### Full runtime dependencies of inets-9.7.2 > > erts-14.0, kernel-9.0, mnesia-4.12, public_key-1.13, runtime_tools-1.8.14, > ssl-9.0, stdlib-5.0, stdlib-6.0 # megaco-4.9.2 The megaco-4.9.2 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - Numeric fields in megaco text-encoded messages are now validated for digit-string length before integer conversion, improving robustness of the text decoder. Per-field digit limits based on the H.248.1 ASN.1 type constraints are enforced (e.g., 10 digits for UINT32, 2 digits for timer values), along with a 100 KB overall message size cap at the scanner entry point. The binary (BER/PER) codec is not affected. Own Id: OTP-20234 Related Id(s): PR-11325 > #### Full runtime dependencies of megaco-4.9.2 > > asn1-3.0, debugger-4.0, erts-12.0, et-1.5, kernel-8.0, runtime_tools-1.8.14, > stdlib-2.5 # mnesia-4.26.2 The mnesia-4.26.2 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - A transaction iterating a table (first/1, last/1, next/2, prev/2, select, select_reverse on non-ordered_set) leaked a safe_fixtable hold when the coordinator was killed by an external signal. The table remained fixed for the lifetime of the node, preventing space reclamation of deleted objects. Own Id: OTP-20347 Related Id(s): PR-11517 - Fixed a race condition where mnesia_controller could crash if a table was deleted while mnesia:set_master_nodes/2 was being processed. Own Id: OTP-20351 Related Id(s): PR-11554 > #### Full runtime dependencies of mnesia-4.26.2 > > erts-9.0, kernel-5.3, stdlib-5.0 # public_key-1.21.5 The public_key-1.21.5 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - Retain lost CommonName length relaxation. Own Id: OTP-20321 Related Id(s): GH-11240, PR-11358 > #### Full runtime dependencies of public_key-1.21.5 > > asn1-5.0, crypto-5.8, erts-13.0, kernel-8.0, stdlib-4.0 # snmp-5.20.5 The snmp-5.20.5 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - The SNMP PDU decoder now bounds the byte length accepted for INTEGER, Counter32, Gauge32/Unsigned32, TimeTicks, and Counter64 values during decoding (4, 5, 5, 5, and 9 bytes respectively, matching the SMIv2 value ranges), instead of accepting an arbitrarily large byte string and converting it to an integer. Own Id: OTP-20346 Related Id(s): PR-11538 > #### Full runtime dependencies of snmp-5.20.5 > > asn1-5.4, crypto-4.6, erts-12.0, kernel-8.0, mnesia-4.12, > runtime_tools-1.8.14, stdlib-5.0 # ssh-6.0.5 The ssh-6.0.5 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - Fixed a bug where multiple subsystem requests could succeed on same ssh channel which is forbidden by RFC 4254 ??6.5 Own Id: OTP-20284 Related Id(s): PR-11437 > #### Full runtime dependencies of ssh-6.0.5 > > crypto-5.7, erts-14.0, kernel-10.3, public_key-1.6.1, runtime_tools-1.15.1, > stdlib-8.0 # ssl-11.7.5 Note! The ssl-11.7.5 application _cannot_ be applied independently of other applications on an arbitrary OTP 29 installation. On a full OTP 29 installation, also the following runtime dependency has to be satisfied: -- public_key-1.21.1 (first satisfied in OTP 29.0.1) ## Fixed Bugs and Malfunctions - Debugging keylog_hs callback used for logging handshake secrets on failed connections swapped the argument order in logging function confusing server and client side. The bug was introduced in OTP 28.5 Own Id: OTP-20350 Related Id(s): ERIERL-1354, PR-11553 ## Improvements and New Features - Hardening improvements of the ssl application. TLS distribution now defaults to TLS-1.3 instead of TLS-1.2 (TLS-1.2 is kept as fallback for rolling upgrades). TLS-1.2 server with {verify, verify_peer} now defaults reuse_sessions to false to mitigate the Triple Handshake attack (RFC 7627). Set {reuse_sessions, true} explicitly to restore previous behavior. Various missing or faulty sanity checks added and TLS alerts adjusted to comply with RFC MUST requirements, including: signature algorithm validation for intermediate certificates, TLS-1.3 session_id echo, pre_shared_key extension ordering, and renegotiation_info enforcement. Hardened and improved CRL support. Introduces new option allowed_hosts for the optional CRL HTTP fetching feature to restrict which hosts may be contacted. Internal/loopback IPs are now blocked by default (SSRF protection). TLS-1.3 client ticket handling is more robust (locked tickets are released on client crash). Server TLS-1.3 ticket handling and anti-replay Bloom filter performance are optimized. DTLS duplicate ChangeCipherSpec handling simplified, fixing potential state machine confusion (GH-11075). Process state formatting no longer leaks secrets in crash logs. Own Id: OTP-20289 Related Id(s): PR-11478 > #### Full runtime dependencies of ssl-11.7.5 > > crypto-5.8, erts-16.0, inets-5.10.7, kernel-10.3, public_key-1.21.1, > runtime_tools-1.15.1, stdlib-7.0 # stdlib-8.0.4 The stdlib-8.0.4 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - Fixed a bug in unicode_util:gc/1 where the grapheme cluster segmentation of `$\r` (not followed by `$\n`) would decompose binary continuations into mixed chardata. This caused string:trim/3 (and string:chomp/1) to return incorrect results or crash when trimming strings containing binaries followed by another list element. Own Id: OTP-20296 Related Id(s): GH-11380, PR-11464 - `record_info/2` will now mark tuple records as used. Own Id: OTP-20301 Related Id(s): ERIERL-1345, PR-11470 - uri_string:parse/1 now rejects URIs with an unreasonably long port component (more than 5 digits) instead of attempting to convert an arbitrarily large digit string to an integer. Own Id: OTP-20344 Related Id(s): PR-11538 > #### Full runtime dependencies of stdlib-8.0.4 > > compiler-5.0, crypto-4.5, erts-16.0.3, kernel-11.0, sasl-3.0, > syntax_tools-3.2.1 # tools-4.2.2 The tools-4.2.2 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - tools: fixes tprof not stopping tracing A call to `tprof:enable_trace(new|existing)` starts tracing processes. To stop it, one calls `tprof:disable_trace(new|existing)`. However, the guard to stop tracing was matching on `new_processes | existing_processes`. The return happens to say `0` processes are traced now, but the tracing did not stop. This issue has been fixed. Own Id: OTP-20302 Related Id(s): PR-11481 > #### Full runtime dependencies of tools-4.2.2 > > compiler-8.5, crypto-5.9, erts-15.0, kernel-10.0, public_key-1.21, > runtime_tools-2.1, stdlib-6.0 # Thanks to Andrew Bennett, ausimian, Laurynas ??etyrkinas, ruslandoga, Thomas Cioppettini From otp@REDACTED Tue Sep 1 14:35:21 2026 From: otp@REDACTED (Erlang/OTP) Date: Tue, 01 Sep 2026 14:35:21 +0200 (CEST) Subject: Patch Package OTP 28.5.0.6 Released Message-ID: <20260901123521.14E062C53D@hel.cslab.ericsson.net> Patch Package: OTP 28.5.0.6 Git Tag: OTP-28.5.0.6 Date: 2026-09-01 Trouble Report Id: OTP-20135, OTP-20234, OTP-20264, OTP-20265, OTP-20268, OTP-20269, OTP-20270, OTP-20271, OTP-20274, OTP-20278, OTP-20279, OTP-20281, OTP-20282, OTP-20284, OTP-20286, OTP-20289, OTP-20296, OTP-20300, OTP-20302, OTP-20306, OTP-20307, OTP-20308, OTP-20312, OTP-20319, OTP-20320, OTP-20324, OTP-20330, OTP-20333, OTP-20334, OTP-20342, OTP-20343, OTP-20344, OTP-20345, OTP-20346, OTP-20347, OTP-20350, OTP-20351 Seq num: CVE-2026-75538, ERIERL-1354, GH-11052, GH-11278, GH-11308, GH-11380, GH-11404, GH-11416, GH-11419, GH-11423, GH-11494, GH-11511, PR-11298, PR-11325, PR-11388, PR-11417, PR-11425, PR-11428, PR-11429, PR-11437, PR-11463, PR-11464, PR-11478, PR-11481, PR-11485, PR-11492, PR-11503, PR-11505, PR-11509, PR-11513, PR-11517, PR-11521, PR-11533, PR-11538, PR-11539, PR-11540, PR-11541, PR-11542, PR-11543, PR-11544, PR-11545, PR-11546, PR-11547, PR-11548, PR-11553, PR-11554 System: OTP Release: 28 Application: compiler-9.0.6.2, crypto-5.8.3.3, eldap-1.2.16.1, erl_interface-5.7.0.2, erts-16.4.0.6, inets-9.6.2.3, kernel-10.6.3.4, megaco-4.8.3.2, mnesia-4.25.3.2, snmp-5.20.2.2, ssh-5.5.2.5, ssl-11.6.0.5, stdlib-7.3.0.2, tools-4.1.4.1 Predecessor: OTP 28.5.0.5 Check out the git tag OTP-28.5.0.6, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below. # compiler-9.0.6.2 The compiler-9.0.6.2 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - compiler: Fix bug in beam_types:subtract/2 for bitstrings Own Id: OTP-20312 Related Id(s): GH-11494, PR-11503 > #### Full runtime dependencies of compiler-9.0.6.2 > > crypto-5.1, erts-13.0, kernel-8.4, stdlib-6.0 # crypto-5.8.3.3 The crypto-5.8.3.3 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - Fixed type mismatch between `ErlNifUInt64` and `uint64_t` in crypto NIF that caused incompatible-pointer warnings on macOS arm64 when passing DH parameters to OpenSSL. Own Id: OTP-20333 Related Id(s): GH-11511, PR-11513 > #### Full runtime dependencies of crypto-5.8.3.3 > > erts-9.0, kernel-6.0, stdlib-3.9 # eldap-1.2.16.1 The eldap-1.2.16.1 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - eldap referral URL parsing now rejects a port component longer than 5 digits instead of attempting to convert an arbitrarily large digit string to an integer. Own Id: OTP-20345 Related Id(s): PR-11538 > #### Full runtime dependencies of eldap-1.2.16.1 > > asn1-3.0, erts-6.0, kernel-3.0, ssl-5.3.4, stdlib-3.4 # erl_interface-5.7.0.2 The erl_interface-5.7.0.2 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - erl_interface: Fix buffer leak and state corruption on `ei_x_buff` realloc failure Own Id: OTP-20324 Related Id(s): PR-11492 # erts-16.4.0.6 The erts-16.4.0.6 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - No-suspend port command signals (i.e. port command signals sent using the erlang:port_command/3 BIF or the erlang:send/3 BIF with the `nosuspend` option) were not aborted properly in all scenarios which could leave the port queue in a busy state indefinitely. Also asynchronously sent no-suspend command signals (i.e, port command signals sent using the erlang:send/3 BIF with the `nosuspend` option) could sometimes be delivered even though the port was busy. Own Id: OTP-20135 Related Id(s): GH-11052, PR-11463 - erts: Fix missing exit_status caused by SIGCHLD race Own Id: OTP-20274 Related Id(s): GH-11278, PR-11298 - erts: Fix bug in `is_in_range` instruction for x86 JIT Own Id: OTP-20278 Related Id(s): GH-11419, PR-11429 - Fixed bug in `binary_to_term` that could cause emulator crash for specific terms in specific process states (reductions left). Own Id: OTP-20281 Related Id(s): GH-11404, PR-11425 - erts: Fix crash with `term_to_iovec/2` for large binary Own Id: OTP-20282 Related Id(s): PR-11428 - A distributed `priority` send larger than 32 KiB to a process alias caused the receiving runtime system to crash. Own Id: OTP-20286 Related Id(s): GH-11416, PR-11417 - Priority message queue markers were sometimes installed in the message queue even when no priority messages could be received. As a result, the two markers had to be traversed unnecessarily when scanning the message queue, introducing a small but avoidable overhead. Own Id: OTP-20300 Related Id(s): PR-11485 - A monitor of `time_offset` co-created with a process alias (`monitor(time_offset, clock_service, {alias, UnaliasOpt})`) either crashed the runtime system or did not work. This bug was introduced in OTP 25.0. Own Id: OTP-20319 Related Id(s): PR-11509 - A process alias was erroneously created when a remote `spawn_request()` operation with a `{monitor, {alias, explicit_unalias}}` option failed with `noconnection` reason. Own Id: OTP-20330 Related Id(s): PR-11521 - A `gen_tcp` socket using the inet driver and `{packet,4}` had a bug if receiving a packet with size just below INT_MAX. That packet size wrapped in size calculations and made the received data overwrite its allocation and trash allocator metadata and subsequent block(s), causing the VM to crash. This made it possible for anyone to remotely crash an Erlang node that used `{packet,4}` on a reachable socket. This bug has been corrected. Own Id: OTP-20334 Related Id(s): PR-11533, CVE-2026-75538 > #### Full runtime dependencies of erts-16.4.0.6 > > kernel-9.0, sasl-3.3, stdlib-4.1 # inets-9.6.2.3 The inets-9.6.2.3 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - The `dets` and `mnesia` `mod_auth` backends used a key that did not include the directory path, so all `require_user`/`require_group` records collapsed into one per-listener namespace. A user authorized for one protected directory could authenticate against any other protected directory served by the same listener. `{path, Directory}` is now included in the auth backend key, scoping records per directory as documented. Own Id: OTP-20264 Related Id(s): PR-11546 - Requests specifying both `Transfer-Encoding` and `Content-Length` headers are now rejected with `400 Bad Request`, per RFC 9112 Section 6.3. Previously such requests could be used for CL.TE request-smuggling/desync attacks against reverse proxies in front of `httpd`. Own Id: OTP-20268 Related Id(s): PR-11547 - `httpd` accepted the obsolete header line-folding syntax (RFC 9112 Section 5.2, a continuation line beginning with space/tab), silently treating the folded continuation as a separate header. This allowed CL.TE-style request smuggling when `httpd` was placed behind a folding-aware proxy. Such requests are now rejected with `400 Bad Request`. Own Id: OTP-20269 Related Id(s): PR-11544 - A header such as `Content-Length : 6` (whitespace before the colon) was previously silently dropped, causing the content length to default to 0 and the body bytes to be misinterpreted as a pipelined request (CL.0 smuggling). Per RFC 7230 Section 3.2.4, such headers are now rejected with `400 Bad Request`. Own Id: OTP-20270 Related Id(s): PR-11545 - A new httpd option `request_timeout` (default 60 seconds, renamed from the interim `max_body_read_timeout`) bounds the idle time between reads of a request body/message. The server now also sends `408 Request Timeout` when the `min_bytes_per_second` floor is hit, and `keep_alive_timeout` measurement was corrected so the timer is cancelled as soon as new data arrives rather than only after full header parsing; `keep_alive_timeout` and `request_timeout` now also accept `infinity` to disable the timeout. Own Id: OTP-20271 Related Id(s): PR-11543 - `mod_auth`, `mod_security`, and `mod_get` compared resolved filesystem paths against configured protected-directory patterns without normalizing repeated slashes or filesystem case. On case-insensitive filesystems (macOS, Windows) or with repeated slashes, a request could resolve to a protected resource while evading the directory match. Paths are now canonicalized (slash-collapsed, and case-normalized when the filesystem is case-insensitive) before the authorization decision. Own Id: OTP-20279 Related Id(s): PR-11542 - A request with an invalid chunked transfer-encoding chunk size previously caused the httpd connection handler to hang indefinitely without requiring further input from the client. This leaked a process per request and could be used to exhaust server resources (denial of service). Invalid chunk sizes are now rejected immediately with an error response, and the connection is closed. Own Id: OTP-20306 Related Id(s): PR-11539 - `max_body_size` was previously enforced only after a complete chunk had been received, allowing a single oversized chunk to be buffered in full before the limit was checked ??? undermining the memory-exhaustion protection the option is meant to provide. The limit is now enforced incrementally as chunk data arrives, rejecting the request as soon as the configured size is exceeded. Own Id: OTP-20307 Related Id(s): PR-11540 - The documented default of 150 for the `max_clients` option was not applied by the implementation, allowing an unbounded number of concurrent clients to connect regardless of configuration. The default is now correctly enforced. Own Id: OTP-20308 Related Id(s): PR-11541 - Fixed a bug where httpd failed to start when configured with {socket_type, {ip_comm, SockOpts}} and a fixed (non-zero) port. Own Id: OTP-20342 Related Id(s): PR-11548 - `httpc` now enforces a limit on the total size of response headers and response body, preventing unbounded memory allocation when connecting to a malicious or malfunctioning server. The new max_header_size and max_body_size request options can be used to override the default limit (10240 bytes for headers). Additionally, httpc now validates that the Content-Length header contains only digits before use, avoiding a crash on malformed responses. Own Id: OTP-20343 Related Id(s): PR-11538 > #### Full runtime dependencies of inets-9.6.2.3 > > erts-14.0, kernel-9.0, mnesia-4.12, public_key-1.13, runtime_tools-1.8.14, > ssl-9.0, stdlib-5.0, stdlib-6.0 # kernel-10.6.3.4 The kernel-10.6.3.4 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - A field in `net_kernel`'s internal state was not cleaned up in some cases for failed connections could cause the state to grow indefinitely over time. This has now been fixed. Own Id: OTP-20265 Related Id(s): GH-11308, PR-11388 > #### Full runtime dependencies of kernel-10.6.3.4 > > crypto-5.0, erts-15.2.5, sasl-3.0, stdlib-7.0 # megaco-4.8.3.2 The megaco-4.8.3.2 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - Numeric fields in megaco text-encoded messages are now validated for digit-string length before integer conversion, improving robustness of the text decoder. Per-field digit limits based on the H.248.1 ASN.1 type constraints are enforced (e.g., 10 digits for UINT32, 2 digits for timer values), along with a 100 KB overall message size cap at the scanner entry point. The binary (BER/PER) codec is not affected. Own Id: OTP-20234 Related Id(s): PR-11325 > #### Full runtime dependencies of megaco-4.8.3.2 > > asn1-3.0, debugger-4.0, erts-12.0, et-1.5, kernel-8.0, runtime_tools-1.8.14, > stdlib-2.5 # mnesia-4.25.3.2 The mnesia-4.25.3.2 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - A transaction iterating a table (first/1, last/1, next/2, prev/2, select, select_reverse on non-ordered_set) leaked a safe_fixtable hold when the coordinator was killed by an external signal. The table remained fixed for the lifetime of the node, preventing space reclamation of deleted objects. Own Id: OTP-20347 Related Id(s): PR-11517 - Fixed a race condition where mnesia_controller could crash if a table was deleted while mnesia:set_master_nodes/2 was being processed. Own Id: OTP-20351 Related Id(s): PR-11554 > #### Full runtime dependencies of mnesia-4.25.3.2 > > erts-9.0, kernel-5.3, stdlib-5.0 # snmp-5.20.2.2 The snmp-5.20.2.2 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - The SNMP PDU decoder now bounds the byte length accepted for INTEGER, Counter32, Gauge32/Unsigned32, TimeTicks, and Counter64 values during decoding (4, 5, 5, 5, and 9 bytes respectively, matching the SMIv2 value ranges), instead of accepting an arbitrarily large byte string and converting it to an integer. Own Id: OTP-20346 Related Id(s): PR-11538 > #### Full runtime dependencies of snmp-5.20.2.2 > > asn1-5.4, crypto-4.6, erts-12.0, kernel-8.0, mnesia-4.12, > runtime_tools-1.8.14, stdlib-5.0 # ssh-5.5.2.5 Note! The ssh-5.5.2.5 application _cannot_ be applied independently of other applications on an arbitrary OTP 28 installation. On a full OTP 28 installation, also the following runtime dependency has to be satisfied: -- crypto-5.7 (first satisfied in OTP 28.1) ## Fixed Bugs and Malfunctions - Fixed a bug where multiple subsystem requests could succeed on same ssh channel which is forbidden by RFC 4254 ??6.5 Own Id: OTP-20284 Related Id(s): PR-11437 > #### Full runtime dependencies of ssh-5.5.2.5 > > crypto-5.7, erts-14.0, kernel-10.3, public_key-1.6.1, runtime_tools-1.15.1, > stdlib-5.0, stdlib-6.0 # ssl-11.6.0.5 Note! The ssl-11.6.0.5 application _cannot_ be applied independently of other applications on an arbitrary OTP 28 installation. On a full OTP 28 installation, also the following runtime dependencies have to be satisfied: -- crypto-5.8 (first satisfied in OTP 28.3) -- public_key-1.20.3.1 (first satisfied in OTP 28.5.0.1) ## Fixed Bugs and Malfunctions - Debugging keylog_hs callback used for logging handshake secrets on failed connections swapped the argument order in logging function confusing server and client side. The bug was introduced in OTP 28.5 Own Id: OTP-20350 Related Id(s): ERIERL-1354, PR-11553 ## Improvements and New Features - Hardening improvements of the ssl application. TLS distribution now defaults to TLS-1.3 instead of TLS-1.2 (TLS-1.2 is kept as fallback for rolling upgrades). TLS-1.2 server with {verify, verify_peer} now defaults reuse_sessions to false to mitigate the Triple Handshake attack (RFC 7627). Set {reuse_sessions, true} explicitly to restore previous behavior. Various missing or faulty sanity checks added and TLS alerts adjusted to comply with RFC MUST requirements, including: signature algorithm validation for intermediate certificates, TLS-1.3 session_id echo, pre_shared_key extension ordering, and renegotiation_info enforcement. Hardened and improved CRL support. Introduces new option allowed_hosts for the optional CRL HTTP fetching feature to restrict which hosts may be contacted. Internal/loopback IPs are now blocked by default (SSRF protection). TLS-1.3 client ticket handling is more robust (locked tickets are released on client crash). Server TLS-1.3 ticket handling and anti-replay Bloom filter performance are optimized. DTLS duplicate ChangeCipherSpec handling simplified, fixing potential state machine confusion (GH-11075). Process state formatting no longer leaks secrets in crash logs. Own Id: OTP-20289 Related Id(s): PR-11478 > #### Full runtime dependencies of ssl-11.6.0.5 > > crypto-5.8, erts-16.0, inets-5.10.7, kernel-10.3, public_key-1.20.3.1, > runtime_tools-1.15.1, stdlib-7.0 # stdlib-7.3.0.2 Note! The stdlib-7.3.0.2 application _cannot_ be applied independently of other applications on an arbitrary OTP 28 installation. On a full OTP 28 installation, also the following runtime dependency has to be satisfied: -- erts-16.0.3 (first satisfied in OTP 28.0.3) ## Fixed Bugs and Malfunctions - Fixed a bug in unicode_util:gc/1 where the grapheme cluster segmentation of `$\r` (not followed by `$\n`) would decompose binary continuations into mixed chardata. This caused string:trim/3 (and string:chomp/1) to return incorrect results or crash when trimming strings containing binaries followed by another list element. Own Id: OTP-20296 Related Id(s): GH-11380, PR-11464 - When compiling a module with a triple-quoted string with escape sequences and a chunk boundary happened to fall just after an escape character, that character was not passed to the reentrancy continuation, so the scanner interpreted the following characters as not an escape sequence. This bug has now been fixed. Own Id: OTP-20320 Related Id(s): GH-11423, PR-11505 - uri_string:parse/1 now rejects URIs with an unreasonably long port component (more than 5 digits) instead of attempting to convert an arbitrarily large digit string to an integer. Own Id: OTP-20344 Related Id(s): PR-11538 > #### Full runtime dependencies of stdlib-7.3.0.2 > > compiler-5.0, crypto-4.5, erts-16.0.3, kernel-10.0, sasl-3.0, > syntax_tools-3.2.1 # tools-4.1.4.1 The tools-4.1.4.1 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - tools: fixes tprof not stopping tracing A call to `tprof:enable_trace(new|existing)` starts tracing processes. To stop it, one calls `tprof:disable_trace(new|existing)`. However, the guard to stop tracing was matching on `new_processes | existing_processes`. The return happens to say `0` processes are traced now, but the tracing did not stop. This issue has been fixed. Own Id: OTP-20302 Related Id(s): PR-11481 > #### Full runtime dependencies of tools-4.1.4.1 > > compiler-8.5, erts-15.0, erts-15.0, kernel-10.0, runtime_tools-2.1, stdlib-6.0 # Thanks to Andrew Bennett, Laurynas ??etyrkinas, ruslandoga, Thomas Cioppettini From otp@REDACTED Tue Sep 1 15:31:32 2026 From: otp@REDACTED (Erlang/OTP) Date: Tue, 01 Sep 2026 15:31:32 +0200 (CEST) Subject: Patch Package OTP 27.3.4.17 Released Message-ID: <20260901133132.CF1A92C540@hel.cslab.ericsson.net> Patch Package: OTP 27.3.4.17 Git Tag: OTP-27.3.4.17 Date: 2026-09-01 Trouble Report Id: OTP-20135, OTP-20234, OTP-20264, OTP-20265, OTP-20268, OTP-20269, OTP-20270, OTP-20271, OTP-20273, OTP-20278, OTP-20279, OTP-20281, OTP-20282, OTP-20284, OTP-20289, OTP-20296, OTP-20302, OTP-20306, OTP-20307, OTP-20308, OTP-20312, OTP-20319, OTP-20320, OTP-20324, OTP-20330, OTP-20333, OTP-20334, OTP-20342, OTP-20343, OTP-20344, OTP-20345, OTP-20346, OTP-20347, OTP-20349, OTP-20351 Seq num: CVE-2026-75538, ERIERL-1352, GH-11052, GH-11278, GH-11308, GH-11380, GH-11404, GH-11419, GH-11423, GH-11494, GH-11511, OTP-20037, OTP-20199, PR-11247, PR-11285, PR-11325, PR-11388, PR-11425, PR-11428, PR-11429, PR-11437, PR-11463, PR-11464, PR-11478, PR-11481, PR-11492, PR-11503, PR-11505, PR-11509, PR-11513, PR-11517, PR-11521, PR-11533, PR-11538, PR-11539, PR-11540, PR-11541, PR-11542, PR-11543, PR-11544, PR-11545, PR-11546, PR-11547, PR-11548, PR-11554 System: OTP Release: 27 Application: compiler-8.6.1.6, crypto-5.5.3.5, eldap-1.2.14.2, erl_interface-5.5.2.2, erts-15.2.7.13, inets-9.3.2.7, kernel-10.2.7.5, megaco-4.7.2.3, mnesia-4.23.5.4, snmp-5.18.2.1, ssh-5.2.11.12, ssl-11.2.12.12, stdlib-6.2.2.5, tools-4.1.1.1 Predecessor: OTP 27.3.4.16 Check out the git tag OTP-27.3.4.17, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below. # compiler-8.6.1.6 The compiler-8.6.1.6 application can be applied independently of other applications on a full OTP 27 installation. ## Fixed Bugs and Malfunctions - compiler: Fix bug in beam_types:subtract/2 for bitstrings Own Id: OTP-20312 Related Id(s): GH-11494, PR-11503 > #### Full runtime dependencies of compiler-8.6.1.6 > > crypto-5.1, erts-13.0, kernel-8.4, stdlib-6.0 # crypto-5.5.3.5 The crypto-5.5.3.5 application can be applied independently of other applications on a full OTP 27 installation. ## Fixed Bugs and Malfunctions - Fixed type mismatch between `ErlNifUInt64` and `uint64_t` in crypto NIF that caused incompatible-pointer warnings on macOS arm64 when passing DH parameters to OpenSSL. Own Id: OTP-20333 Related Id(s): GH-11511, PR-11513 > #### Full runtime dependencies of crypto-5.5.3.5 > > erts-9.0, kernel-5.3, stdlib-3.9 # eldap-1.2.14.2 The eldap-1.2.14.2 application can be applied independently of other applications on a full OTP 27 installation. ## Fixed Bugs and Malfunctions - eldap referral URL parsing now rejects a port component longer than 5 digits instead of attempting to convert an arbitrarily large digit string to an integer. Own Id: OTP-20345 Related Id(s): PR-11538 > #### Full runtime dependencies of eldap-1.2.14.2 > > asn1-3.0, erts-6.0, kernel-3.0, ssl-5.3.4, stdlib-3.4 # erl_interface-5.5.2.2 The erl_interface-5.5.2.2 application can be applied independently of other applications on a full OTP 27 installation. ## Fixed Bugs and Malfunctions - erl_interface: Fix buffer leak and state corruption on `ei_x_buff` realloc failure Own Id: OTP-20324 Related Id(s): PR-11492 # erts-15.2.7.13 The erts-15.2.7.13 application can be applied independently of other applications on a full OTP 27 installation. ## Fixed Bugs and Malfunctions - No-suspend port command signals (i.e. port command signals sent using the erlang:port_command/3 BIF or the erlang:send/3 BIF with the `nosuspend` option) were not aborted properly in all scenarios which could leave the port queue in a busy state indefinitely. Also asynchronously sent no-suspend command signals (i.e, port command signals sent using the erlang:send/3 BIF with the `nosuspend` option) could sometimes be delivered even though the port was busy. Own Id: OTP-20135 Related Id(s): GH-11052, PR-11463 - erts: Fix missing exit_status caused by SIGCHLD race Own Id: OTP-20273 Related Id(s): GH-11278, PR-11285 - erts: Fix bug in `is_in_range` instruction for x86 JIT Own Id: OTP-20278 Related Id(s): GH-11419, PR-11429 - Fixed bug in `binary_to_term` that could cause emulator crash for specific terms in specific process states (reductions left). Own Id: OTP-20281 Related Id(s): GH-11404, PR-11425 - erts: Fix crash with `term_to_iovec/2` for large binary Own Id: OTP-20282 Related Id(s): PR-11428 - A monitor of `time_offset` co-created with a process alias (`monitor(time_offset, clock_service, {alias, UnaliasOpt})`) either crashed the runtime system or did not work. This bug was introduced in OTP 25.0. Own Id: OTP-20319 Related Id(s): PR-11509 - A process alias was erroneously created when a remote `spawn_request()` operation with a `{monitor, {alias, explicit_unalias}}` option failed with `noconnection` reason. Own Id: OTP-20330 Related Id(s): PR-11521 - A `gen_tcp` socket using the inet driver and `{packet,4}` had a bug if receiving a packet with size just below INT_MAX. That packet size wrapped in size calculations and made the received data overwrite its allocation and trash allocator metadata and subsequent block(s), causing the VM to crash. This made it possible for anyone to remotely crash an Erlang node that used `{packet,4}` on a reachable socket. This bug has been corrected. Own Id: OTP-20334 Related Id(s): PR-11533, CVE-2026-75538 > #### Full runtime dependencies of erts-15.2.7.13 > > kernel-9.0, sasl-3.3, stdlib-4.1 # inets-9.3.2.7 The inets-9.3.2.7 application can be applied independently of other applications on a full OTP 27 installation. ## Fixed Bugs and Malfunctions - The `dets` and `mnesia` `mod_auth` backends used a key that did not include the directory path, so all `require_user`/`require_group` records collapsed into one per-listener namespace. A user authorized for one protected directory could authenticate against any other protected directory served by the same listener. `{path, Directory}` is now included in the auth backend key, scoping records per directory as documented. Own Id: OTP-20264 Related Id(s): PR-11546 - Requests specifying both `Transfer-Encoding` and `Content-Length` headers are now rejected with `400 Bad Request`, per RFC 9112 Section 6.3. Previously such requests could be used for CL.TE request-smuggling/desync attacks against reverse proxies in front of `httpd`. Own Id: OTP-20268 Related Id(s): PR-11547 - `httpd` accepted the obsolete header line-folding syntax (RFC 9112 Section 5.2, a continuation line beginning with space/tab), silently treating the folded continuation as a separate header. This allowed CL.TE-style request smuggling when `httpd` was placed behind a folding-aware proxy. Such requests are now rejected with `400 Bad Request`. Own Id: OTP-20269 Related Id(s): PR-11544 - A header such as `Content-Length : 6` (whitespace before the colon) was previously silently dropped, causing the content length to default to 0 and the body bytes to be misinterpreted as a pipelined request (CL.0 smuggling). Per RFC 7230 Section 3.2.4, such headers are now rejected with `400 Bad Request`. Own Id: OTP-20270 Related Id(s): PR-11545 - A new httpd option `request_timeout` (default 60 seconds, renamed from the interim `max_body_read_timeout`) bounds the idle time between reads of a request body/message. The server now also sends `408 Request Timeout` when the `min_bytes_per_second` floor is hit, and `keep_alive_timeout` measurement was corrected so the timer is cancelled as soon as new data arrives rather than only after full header parsing; `keep_alive_timeout` and `request_timeout` now also accept `infinity` to disable the timeout. Own Id: OTP-20271 Related Id(s): PR-11543 - `mod_auth`, `mod_security`, and `mod_get` compared resolved filesystem paths against configured protected-directory patterns without normalizing repeated slashes or filesystem case. On case-insensitive filesystems (macOS, Windows) or with repeated slashes, a request could resolve to a protected resource while evading the directory match. Paths are now canonicalized (slash-collapsed, and case-normalized when the filesystem is case-insensitive) before the authorization decision. Own Id: OTP-20279 Related Id(s): PR-11542 - A request with an invalid chunked transfer-encoding chunk size previously caused the httpd connection handler to hang indefinitely without requiring further input from the client. This leaked a process per request and could be used to exhaust server resources (denial of service). Invalid chunk sizes are now rejected immediately with an error response, and the connection is closed. Own Id: OTP-20306 Related Id(s): PR-11539 - `max_body_size` was previously enforced only after a complete chunk had been received, allowing a single oversized chunk to be buffered in full before the limit was checked ??? undermining the memory-exhaustion protection the option is meant to provide. The limit is now enforced incrementally as chunk data arrives, rejecting the request as soon as the configured size is exceeded. Own Id: OTP-20307 Related Id(s): PR-11540 - The documented default of 150 for the `max_clients` option was not applied by the implementation, allowing an unbounded number of concurrent clients to connect regardless of configuration. The default is now correctly enforced. Own Id: OTP-20308 Related Id(s): PR-11541 - Fixed a bug where httpd failed to start when configured with {socket_type, {ip_comm, SockOpts}} and a fixed (non-zero) port. Own Id: OTP-20342 Related Id(s): PR-11548 - `httpc` now enforces a limit on the total size of response headers and response body, preventing unbounded memory allocation when connecting to a malicious or malfunctioning server. The new max_header_size and max_body_size request options can be used to override the default limit (10240 bytes for headers). Additionally, httpc now validates that the Content-Length header contains only digits before use, avoiding a crash on malformed responses. Own Id: OTP-20343 Related Id(s): PR-11538 > #### Full runtime dependencies of inets-9.3.2.7 > > erts-14.0, kernel-9.0, mnesia-4.12, public_key-1.13, runtime_tools-1.8.14, > ssl-9.0, stdlib-5.0, stdlib-6.0 # kernel-10.2.7.5 Note! The kernel-10.2.7.5 application _cannot_ be applied independently of other applications on an arbitrary OTP 27 installation. On a full OTP 27 installation, also the following runtime dependency has to be satisfied: -- erts-15.2.5 (first satisfied in OTP 27.3.2) ## Fixed Bugs and Malfunctions - A field in `net_kernel`'s internal state was not cleaned up in some cases for failed connections could cause the state to grow indefinitely over time. This has now been fixed. Own Id: OTP-20265 Related Id(s): GH-11308, PR-11388 - Handling of the truncation bit in `inet_res` has been fixed so it properly falls back to querying over TCP after a truncated UDP reply. This fixes a bug introduced in OTP-27.3.4.10, kernel-10.2.7.4 making a truncated UDP answer fail to parse and never execute the fallback, instead the name resolve operation fails. Own Id: OTP-20349 Related Id(s): ERIERL-1352, PR-11247, OTP-20037, OTP-20199 > #### Full runtime dependencies of kernel-10.2.7.5 > > crypto-5.0, erts-15.2.5, sasl-3.0, stdlib-6.0 # megaco-4.7.2.3 The megaco-4.7.2.3 application can be applied independently of other applications on a full OTP 27 installation. ## Fixed Bugs and Malfunctions - Numeric fields in megaco text-encoded messages are now validated for digit-string length before integer conversion, improving robustness of the text decoder. Per-field digit limits based on the H.248.1 ASN.1 type constraints are enforced (e.g., 10 digits for UINT32, 2 digits for timer values), along with a 100 KB overall message size cap at the scanner entry point. The binary (BER/PER) codec is not affected. Own Id: OTP-20234 Related Id(s): PR-11325 > #### Full runtime dependencies of megaco-4.7.2.3 > > asn1-3.0, debugger-4.0, erts-12.0, et-1.5, kernel-8.0, runtime_tools-1.8.14, > stdlib-2.5 # mnesia-4.23.5.4 The mnesia-4.23.5.4 application can be applied independently of other applications on a full OTP 27 installation. ## Fixed Bugs and Malfunctions - A transaction iterating a table (first/1, last/1, next/2, prev/2, select, select_reverse on non-ordered_set) leaked a safe_fixtable hold when the coordinator was killed by an external signal. The table remained fixed for the lifetime of the node, preventing space reclamation of deleted objects. Own Id: OTP-20347 Related Id(s): PR-11517 - Fixed a race condition where mnesia_controller could crash if a table was deleted while mnesia:set_master_nodes/2 was being processed. Own Id: OTP-20351 Related Id(s): PR-11554 > #### Full runtime dependencies of mnesia-4.23.5.4 > > erts-9.0, kernel-5.3, stdlib-5.0 # snmp-5.18.2.1 The snmp-5.18.2.1 application can be applied independently of other applications on a full OTP 27 installation. ## Fixed Bugs and Malfunctions - The SNMP PDU decoder now bounds the byte length accepted for INTEGER, Counter32, Gauge32/Unsigned32, TimeTicks, and Counter64 values during decoding (4, 5, 5, 5, and 9 bytes respectively, matching the SMIv2 value ranges), instead of accepting an arbitrarily large byte string and converting it to an integer. Own Id: OTP-20346 Related Id(s): PR-11538 > #### Full runtime dependencies of snmp-5.18.2.1 > > crypto-4.6, erts-12.0, kernel-8.0, mnesia-4.12, runtime_tools-1.8.14, > stdlib-5.0 # ssh-5.2.11.12 The ssh-5.2.11.12 application can be applied independently of other applications on a full OTP 27 installation. ## Fixed Bugs and Malfunctions - Fixed a bug where multiple subsystem requests could succeed on same ssh channel which is forbidden by RFC 4254 ??6.5 Own Id: OTP-20284 Related Id(s): PR-11437 > #### Full runtime dependencies of ssh-5.2.11.12 > > crypto-5.0, erts-14.0, kernel-9.0, public_key-1.6.1, runtime_tools-1.15.1, > stdlib-5.0, stdlib-6.0 # ssl-11.2.12.12 Note! The ssl-11.2.12.12 application _cannot_ be applied independently of other applications on an arbitrary OTP 27 installation. On a full OTP 27 installation, also the following runtime dependency has to be satisfied: -- public_key-1.17.1.3 (first satisfied in OTP 27.3.4.12) ## Improvements and New Features - Hardening improvements of the ssl application. TLS distribution now defaults to TLS-1.3 instead of TLS-1.2 (TLS-1.2 is kept as fallback for rolling upgrades). TLS-1.2 server with {verify, verify_peer} now defaults reuse_sessions to false to mitigate the Triple Handshake attack (RFC 7627). Set {reuse_sessions, true} explicitly to restore previous behavior. Various missing or faulty sanity checks added and TLS alerts adjusted to comply with RFC MUST requirements, including: signature algorithm validation for intermediate certificates, TLS-1.3 session_id echo, pre_shared_key extension ordering, and renegotiation_info enforcement. Hardened and improved CRL support. Introduces new option allowed_hosts for the optional CRL HTTP fetching feature to restrict which hosts may be contacted. Internal/loopback IPs are now blocked by default (SSRF protection). TLS-1.3 client ticket handling is more robust (locked tickets are released on client crash). Server TLS-1.3 ticket handling and anti-replay Bloom filter performance are optimized. DTLS duplicate ChangeCipherSpec handling simplified, fixing potential state machine confusion (GH-11075). Process state formatting no longer leaks secrets in crash logs. Own Id: OTP-20289 Related Id(s): PR-11478 > #### Full runtime dependencies of ssl-11.2.12.12 > > crypto-5.1, erts-15.0, inets-5.10.7, kernel-9.0, public_key-1.17.1.3, > runtime_tools-1.15.1, stdlib-6.0 # stdlib-6.2.2.5 The stdlib-6.2.2.5 application can be applied independently of other applications on a full OTP 27 installation. ## Fixed Bugs and Malfunctions - Fixed a bug in unicode_util:gc/1 where the grapheme cluster segmentation of `$\r` (not followed by `$\n`) would decompose binary continuations into mixed chardata. This caused string:trim/3 (and string:chomp/1) to return incorrect results or crash when trimming strings containing binaries followed by another list element. Own Id: OTP-20296 Related Id(s): GH-11380, PR-11464 - When compiling a module with a triple-quoted string with escape sequences and a chunk boundary happened to fall just after an escape character, that character was not passed to the reentrancy continuation, so the scanner interpreted the following characters as not an escape sequence. This bug has now been fixed. Own Id: OTP-20320 Related Id(s): GH-11423, PR-11505 - uri_string:parse/1 now rejects URIs with an unreasonably long port component (more than 5 digits) instead of attempting to convert an arbitrarily large digit string to an integer. Own Id: OTP-20344 Related Id(s): PR-11538 > #### Full runtime dependencies of stdlib-6.2.2.5 > > compiler-5.0, crypto-4.5, erts-15.0, kernel-10.0, sasl-3.0 # tools-4.1.1.1 The tools-4.1.1.1 application can be applied independently of other applications on a full OTP 27 installation. ## Fixed Bugs and Malfunctions - tools: fixes tprof not stopping tracing A call to `tprof:enable_trace(new|existing)` starts tracing processes. To stop it, one calls `tprof:disable_trace(new|existing)`. However, the guard to stop tracing was matching on `new_processes | existing_processes`. The return happens to say `0` processes are traced now, but the tracing did not stop. This issue has been fixed. Own Id: OTP-20302 Related Id(s): PR-11481 > #### Full runtime dependencies of tools-4.1.1.1 > > compiler-8.5, erts-15.0, erts-15.0, kernel-10.0, runtime_tools-2.1, stdlib-6.0 # Thanks to Laurynas ??etyrkinas, ruslandoga, Thomas Cioppettini From otp@REDACTED Wed Sep 16 12:48:35 2026 From: otp@REDACTED (Erlang/OTP) Date: Wed, 16 Sep 2026 12:48:35 +0200 (CEST) Subject: Patch Package OTP 29.1 Released Message-ID: <20260916104835.E46932C53D@hel.cslab.ericsson.net> Patch Package: OTP 29.1 Git Tag: OTP-29.1 Date: 2026-09-16 Trouble Report Id: OTP-19631, OTP-20118, OTP-20131, OTP-20145, OTP-20152, OTP-20158, OTP-20169, OTP-20175, OTP-20177, OTP-20180, OTP-20187, OTP-20188, OTP-20189, OTP-20209, OTP-20211, OTP-20213, OTP-20218, OTP-20228, OTP-20235, OTP-20236, OTP-20238, OTP-20246, OTP-20249, OTP-20254, OTP-20255, OTP-20256, OTP-20262, OTP-20265, OTP-20267, OTP-20276, OTP-20277, OTP-20280, OTP-20290, OTP-20291, OTP-20292, OTP-20293, OTP-20295, OTP-20297, OTP-20298, OTP-20303, OTP-20304, OTP-20305, OTP-20309, OTP-20316, OTP-20317, OTP-20318, OTP-20320, OTP-20322, OTP-20326, OTP-20327, OTP-20328, OTP-20331, OTP-20335, OTP-20338, OTP-20339, OTP-20352, OTP-20354, OTP-20356, OTP-20358, OTP-20362, OTP-20364, OTP-20365, OTP-20367, OTP-20373, OTP-20374 Seq num: ERIERL-1356, GH-10879, GH-10968, GH-11093, GH-11119, GH-11155, GH-11248, GH-11308, GH-11338, GH-11344, GH-11349, GH-11351, GH-11352, GH-11360, GH-11366, GH-11367, GH-11397, GH-11398, GH-11401, GH-11406, GH-11413, GH-11414, GH-11423, GH-11472, GH-11534, GH-4417, GH-7862, GH-9302, OTP-20102, PR-10297, PR-11074, PR-11096, PR-11097, PR-11115, PR-11128, PR-11129, PR-11130, PR-11133, PR-11137, PR-11144, PR-11159, PR-11165, PR-11167, PR-11170, PR-11196, PR-11203, PR-11216, PR-11226, PR-11249, PR-11260, PR-11274, PR-11284, PR-11300, PR-11313, PR-11316, PR-11324, PR-11335, PR-11345, PR-11356, PR-11359, PR-11361, PR-11363, PR-11375, PR-11376, PR-11378, PR-11379, PR-11388, PR-11390, PR-11391, PR-11396, PR-11410, PR-11422, PR-11424, PR-11426, PR-11438, PR-11440, PR-11442, PR-11444, PR-11446, PR-11447, PR-11460, PR-11466, PR-11477, PR-11501, PR-11505, PR-11507, PR-11530, PR-11552, PR-11556, PR-11563, PR-11566, PR-11567, PR-11570, PR-11574, PR-11600 System: OTP Release: 29 Application: asn1-5.5.1, common_test-1.31.2, compiler-10.0.5, crypto-5.10, dialyzer-6.0.3, erts-17.1, inets-9.8, kernel-11.0.4, mnesia-4.27, odbc-2.17.1, public_key-1.21.6, runtime_tools-2.5, ssl-11.7.6, stdlib-8.1, syntax_tools-4.1.1, tools-4.2.3, wx-2.7 Predecessor: OTP 29.0.6 Check out the git tag OTP-29.1, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below. # POTENTIAL INCOMPATIBILITIES - When `beam_lib` returns an error tuple, the filename in the information tuple is now a list of characters instead of an atom. Example: 1> beam_lib:chunks(code:which(lists), ["nope"]). {error,beam_lib, {missing_chunk,".../git/otp/lib/stdlib/ebin/lists.beam", "nope"}} The reason for this change is that a long file name is not guaranteed to fit in an atom. Applications or tools that do deep inspection of the `beam_lib` errors (not recommended) will need to be updated. Own Id: OTP-20118 Application(s): stdlib Related Id(s): PR-11167 # OTP-29.1 ## Improvements and New Features - A new `versions` module has been added to the `runtime_tools` application containing functions for, e.g., comparing, versions that adhere to the [OTP Versions Scheme]. The documentation of the OTP Versions Scheme has also been improved. Own Id: OTP-20352 Related Id(s): PR-11556, PR-11600 # asn1-5.5.1 The asn1-5.5.1 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - The modern representation of BITSTRINGs is now always supported for encoding, regardless of any legacy options given. The JER backend would not support the modern representation when any legacy option was given. Own Id: OTP-20145 Related Id(s): PR-11097 - The `make clean` command did not remove all generated `.erl` files. Own Id: OTP-20295 Related Id(s): PR-11375 > #### Full runtime dependencies of asn1-5.5.1 > > erts-14.0, kernel-9.0, stdlib-5.0 # common_test-1.31.2 The common_test-1.31.2 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - The internal `cte_track` event handler now correctly displays the suite name for suites without an `init_per_suite/1` callback. Own Id: OTP-20316 Related Id(s): PR-11501 > #### Full runtime dependencies of common_test-1.31.2 > > compiler-10.0, crypto-4.5, debugger-4.1, erts-7.0, ftp-1.0, inets-6.0, > kernel-11.0, observer-2.1, runtime_tools-1.8.16, sasl-2.5, snmp-5.1.2, > ssh-4.0, stdlib-8.0, syntax_tools-1.7, tools-3.2, xmerl-1.3.8 # compiler-10.0.5 The compiler-10.0.5 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - Fixed a native record crash in the `sys_core_fold` compiler pass. Own Id: OTP-20254 Related Id(s): GH-11351, PR-11359 - The compiler could crash when compiling a map comprehension. Own Id: OTP-20255 Related Id(s): GH-11352, PR-11363 - Fixed a crash when the key pattern in a map comprehension was a bitstring. Own Id: OTP-20262 Related Id(s): GH-11367, PR-11379 - Fixed an issue that could crash the compiler when compiling comprehensions with the `compr_assign` feature enabled. Own Id: OTP-20267 Related Id(s): GH-11366, PR-11390 - Code that called `erlang:0()` inside a fun could crash the compiler. Own Id: OTP-20280 Related Id(s): GH-11414, PR-11424 - Fixed an internal error when lists:keyfind/3 is called with an argument that exceeds system limits. Own Id: OTP-20291 Related Id(s): GH-11413, PR-11444 - An incorrect `useless_building` warning has been eliminated. Own Id: OTP-20304 Related Id(s): GH-11472, PR-11477 - In rare circumstances, the type analysis pass of the compiler could run for many minutes. Own Id: OTP-20365 Related Id(s): GH-11534, PR-11566 > #### Full runtime dependencies of compiler-10.0.5 > > crypto-5.1, erts-13.0, kernel-8.4, stdlib-8.0 # crypto-5.10 The crypto-5.10 application can be applied independently of other applications on a full OTP 29 installation. ## Improvements and New Features - The documentation of the `crypto` module now contains runnable examples for most functions. The examples are verified by the crypto test suite, so they always match actual behavior. Own Id: OTP-20373 Related Id(s): PR-11170 > #### Full runtime dependencies of crypto-5.10 > > erts-9.0, kernel-6.0, stdlib-3.9 # dialyzer-6.0.3 The dialyzer-6.0.3 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - Fixed Dialyzer crash when overriding built-in types. Own Id: OTP-19631 Related Id(s): GH-11093, PR-11096 - Typer crashed when multiple functions were written in the same line. For example: -module(m). f() -> ok. g() -> ok. Own Id: OTP-20297 Related Id(s): PR-11466 > #### Full runtime dependencies of dialyzer-6.0.3 > > compiler-10.0, erts-12.0, kernel-8.0, stdlib-5.0, syntax_tools-2.0 # erts-17.1 The erts-17.1 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - Fixed bug in ets:member/2 for `set`, `bag` and `duplicate_bag`. The bug could (maybe) lead to `ets:member` spuriously returning false for a value which is actually a member for a table that faces high insert load. Own Id: OTP-20152 Related Id(s): PR-11115 - Fixed crashing bug caused by race between timer creating process and suspending receiver of the timer. Only seen to cause crash one time by extremely provoking test case. Bug exists only since OTP 29.0. Own Id: OTP-20175 Related Id(s): PR-11196 - Fixed bug in `enif_realloc_binary` when called with a read-only binary. Instead of returning false at out-of-memory failure, it returned true and did nothing. Own Id: OTP-20187 Related Id(s): PR-11133 - Fixed alternate signal stack sizing on musl (Alpine) running on CPUs whose Linux kernel reports large signal frames (AVX-512/AMX). It caused emulator to abort during startup with "Failed to set alternate signal stack". Own Id: OTP-20213 Related Id(s): GH-11248, PR-11249 - For socket:recvmmsg/6, the buffer length was not handled correctly when the OS network stack truncated the received message, so garbage data with incorrect length could be delivered to the calling process. This bug has been corrected. Own Id: OTP-20246 Related Id(s): PR-11335 - `binary_to_term/1` will now reject an external native record with duplicated fields. Own Id: OTP-20276 Related Id(s): GH-11398, PR-11410 - Fixed a crash upon starting the emulator on systems with a very large minimum signal stack size. Own Id: OTP-20292 Related Id(s): GH-11349, PR-11376 - Fixed lock order violation during crash dump due to export table exhaustion. Only problem for debug emulator. Own Id: OTP-20305 Related Id(s): PR-11460 - Fixed rounding errors when converting large integers to floating point numbers, explicitly with `float/1` or implicitly in arithmetic such as `1.0 * N`. Integers with absolute values larger than 64 bits that could not be represented exactly as a float could be rounded to the second nearest float instead of the nearest. For example, `float(428654966685883400000)` returned `4.2865496668588343e20` instead of the correct `4.286549666858834e20`, which is what `binary_to_float/1` returns for the same number. Own Id: OTP-20317 Related Id(s): PR-11391 - An error check in `prim_inet` has been fixed. This manifested itself as `file:sendfile/*` sometimes crashing instead of returning an error when the remote end closes the socket during initialization. Own Id: OTP-20356 Related Id(s): PR-11438 ## Improvements and New Features - Fairness of code permission locks have been improved to avoid long latencies for code loading and trace operations. Own Id: OTP-20188 Related Id(s): PR-11144 - The BIFs that convert strings to integers (for example `binary_to_integer/1`) are now much faster for huge input strings. On a modern computer, even a string with more than a million decimal digits should finish in less than a second. The `div` and `rem` operators are now also much faster for large operands. Own Id: OTP-20209 Related Id(s): PR-11074, PR-11324 - Arithmetic operations on large integers will now increase the reduction count for the process, causing context switches to occur more frequently when doing arithmetic on large integers. Own Id: OTP-20211 Related Id(s): PR-11274 > #### Full runtime dependencies of erts-17.1 > > kernel-9.0, sasl-3.3, stdlib-4.1 # inets-9.8 The inets-9.8 application can be applied independently of other applications on a full OTP 29 installation. ## Improvements and New Features - OPTIONS is now accepted for HTTP/1.x requests and routed through the normal module pipeline like other standard methods. Requests that no module handles still receive a 501 (Not Implemented) response, so behavior is unchanged for deployments that do not add explicit OPTIONS handling. Own Id: OTP-20249 Related Id(s): GH-11119, PR-11316 > #### Full runtime dependencies of inets-9.8 > > erts-14.0, kernel-9.0, mnesia-4.12, public_key-1.13, runtime_tools-1.8.14, > ssl-9.0, stdlib-5.0, stdlib-6.0 # kernel-11.0.4 The kernel-11.0.4 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - Fixed incorrect TOS format when using `gen_udp` with the `socket` backend. Own Id: OTP-20131 Related Id(s): GH-10968, OTP-20102 - Decoding of names in `inet_res` has been tightened to not allow names longer than 255 octets, as according to RFC 1035. Decoding has also been made more strict by only allowing compression pointers to lower positions in the message. A few bugs when decoding malformed truncated DNS messages have also been fixed, as well as handling broken UTF-8 content in NAPTR RR:s regular expressions field. Own Id: OTP-20228 Related Id(s): PR-11300 - When using the `socket` backend in `gen_tcp`, the default value for the `read_ahead` option was incorrect and has been corrected, according the documentation, to be `true`. Own Id: OTP-20238 Related Id(s): PR-11284 - A field in `net_kernel`'s internal state was not cleaned up in some cases for failed connections could cause the state to grow indefinitely over time. This has now been fixed. Own Id: OTP-20265 Related Id(s): GH-11308, PR-11388 - Fixed pg:which_groups/1 to not include empty groups where all members have leaved. Bug existed since OTP 29.0. Own Id: OTP-20303 Related Id(s): GH-11360, PR-11361 > #### Full runtime dependencies of kernel-11.0.4 > > crypto-5.8, erts-17.0, sasl-3.0, stdlib-8.0 # mnesia-4.27 The mnesia-4.27 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - Fixed mnesia:force_load_table/1 getting stuck when the remote node becomes unreachable during table loading. When a network loader is aborted due to sender node going down and a user has forced a table load, we now retry loading from disc instead. Additionally, for disc_only_copies tables, the process actually loading the table is the dets server process, not the mnesia loader, so it would not receive the abort notification and would hang indefinitely. Now it correctly receives the notification and aborts table loading. Own Id: OTP-20256 Related Id(s): GH-11344, PR-11426 - Fixed incorrect results from `mnesia:select_reverse/2,3` on `ordered_set` tables inside a transaction that had already written to or deleted from the same table. Deleted records could reappear, updated records could appear twice, and the descending order was not preserved. Own Id: OTP-20364 Related Id(s): PR-11563 ## Improvements and New Features - The documentation of the `mnesia` module now contains runnable examples for most functions. The examples are verified by the mnesia test suite, so they always match actual behavior. Own Id: OTP-20374 Related Id(s): PR-11216 > #### Full runtime dependencies of mnesia-4.27 > > erts-9.0, kernel-5.3, stdlib-5.0 # odbc-2.17.1 The odbc-2.17.1 application can be applied independently of other applications on a full OTP 29 installation. ## Improvements and New Features - Added the `max_long_column_size` option to limit buffer allocation size preventing memory exhaustion. Own Id: OTP-20328 Related Id(s): GH-9302, PR-10297 > #### Full runtime dependencies of odbc-2.17.1 > > erts-6.0, kernel-3.0, stdlib-2.0 # public_key-1.21.6 The public_key-1.21.6 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - Added missing `no_cacerts_found` clauses so that the intended `{failed_load_cacerts, no_cacerts_found}` error is raised and formatted properly. Own Id: OTP-20318 Related Id(s): PR-11378 - Align moduli and pubkey_moduli.hrl to state on OTP-28 and newer. Own Id: OTP-20367 Related Id(s): PR-11574 ## Improvements and New Features - Worked around domain component using wrong ASN-1 `PrintableString` encoding instead of `IA5String` encoding. Own Id: OTP-20338 Related Id(s): GH-10879, PR-11226 - ASN.1 files are now compiled sequentially to guarantee reproducible builds. Own Id: OTP-20362 Related Id(s): GH-4417, PR-11396 > #### Full runtime dependencies of public_key-1.21.6 > > asn1-5.0, crypto-5.8, erts-13.0, kernel-8.0, stdlib-4.0 # runtime_tools-2.5 The runtime_tools-2.5 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - Fixed bug if a process that called dbg:session/2 exits before dbg:session_destroy/1 is called. An error report was logged and any trace messages lost and not delivered. Own Id: OTP-20218 Related Id(s): PR-11260 ## Improvements and New Features - A new `versions` module has been added to the `runtime_tools` application containing functions for, e.g., comparing, versions that adhere to the [OTP Versions Scheme]. The documentation of the OTP Versions Scheme has also been improved. Own Id: OTP-20352 Related Id(s): PR-11556, PR-11600 > #### Full runtime dependencies of runtime_tools-2.5 > > erts-16.0, kernel-10.0, mnesia-4.12, stdlib-6.0 # ssl-11.7.6 Note! The ssl-11.7.6 application _cannot_ be applied independently of other applications on an arbitrary OTP 29 installation. On a full OTP 29 installation, also the following runtime dependency has to be satisfied: -- public_key-1.21.1 (first satisfied in OTP 29.0.1) ## Fixed Bugs and Malfunctions - Undecodable `certificate_authorities` names are now skipped, as they are just a hint. Own Id: OTP-20327 Related Id(s): GH-11338, PR-11356 - Corrected generated keylog information generated from the `keylog_hs` option in the corner case that it was invoked after the client had reached its connection state, but the server closed the connection before it reached its connection state. Own Id: OTP-20358 Related Id(s): ERIERL-1356, PR-11570 ## Improvements and New Features - Added TLS-1.3 `selected_group` to ssl:connection_information/2. Own Id: OTP-20326 Related Id(s): PR-11440 - The ECDHE-PSK Chacha20-Poly1305 cipher suites are now supported. This is relevant for TLS-1.2 (and lower). Own Id: OTP-20331 Related Id(s): PR-11345 > #### Full runtime dependencies of ssl-11.7.6 > > crypto-5.8, erts-16.0, inets-5.10.7, kernel-10.3, public_key-1.21.1, > runtime_tools-1.15.1, stdlib-7.0 # stdlib-8.1 The stdlib-8.1 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - When `beam_lib` returns an error tuple, the filename in the information tuple is now a list of characters instead of an atom. Example: 1> beam_lib:chunks(code:which(lists), ["nope"]). {error,beam_lib, {missing_chunk,".../git/otp/lib/stdlib/ebin/lists.beam", "nope"}} The reason for this change is that a long file name is not guaranteed to fit in an atom. Applications or tools that do deep inspection of the `beam_lib` errors (not recommended) will need to be updated. Own Id: OTP-20118 Related Id(s): PR-11167 *** POTENTIAL INCOMPATIBILITY *** - The default seed in the `rand` module has been improved to spread out its entropy over all three seed words. This avoids identical first random numbers from two successive seeds on machines with low system time resolution. Own Id: OTP-20158 Related Id(s): PR-11165 - Fixed unicode:characters_to_binary/2 to handle incomplete utf-32 sequences without crashing. Also fixed a performance regression in unicode:characters_to_nfkd_list/1. Own Id: OTP-20169 Related Id(s): PR-11130 - The `array` module has been improved. array:slice/3 now raises `badarg` for negative lengths. The performance of array:mapfoldl/3 and array:sparse_mapfoldl/3 has been improved. The documentation has been clarified regarding array growth/shrink behavior and how `concat/1,2` handles mixed arrays. Own Id: OTP-20177 Related Id(s): PR-11159 - Added more checks in the linter for badly formed `{Name,Arity}` attributes Own Id: OTP-20277 Related Id(s): GH-11397, PR-11422 - Fixed return value of zip:zip_get/2. When a file was extracted to a directory, the function returned a map instead of a file name. Own Id: OTP-20298 Related Id(s): PR-11313 - When `compr_assign` is enabled, the linter will correctly check for unbounded variables after block expressions in comprehensions. Own Id: OTP-20309 Related Id(s): GH-11406, PR-11567 - When compiling a module with a triple-quoted string with escape sequences and a chunk boundary happened to fall just after an escape character, that character was not passed to the reentrancy continuation, so the scanner interpreted the following characters as not an escape sequence. This bug has now been fixed. Own Id: OTP-20320 Related Id(s): GH-11423, PR-11505 - Fixed some errors in examples in the documentation for the `string` and `uri_string` modules. Own Id: OTP-20322 Related Id(s): PR-11446 - Linter will emit better error messages when a behaviour attribute has a bad module name. Own Id: OTP-20354 Related Id(s): GH-11401, PR-11552 ## Improvements and New Features - uri_string:parse/1 now reports the actual offending character in error tuples instead of reporting a misleading cascade-failure position. Previously, when parsing a URI containing an invalid character (such as `|` or non-ASCII characters like `??`), the error tuple would point to the `:` character ??? the position where the parser's final backtracking attempt failed ??? rather than the character that actually violated the URI grammar. For example, `uri_string:parse("http://localhost/A|B")` returned `{error,invalid_uri,":"}` instead of the more helpful `{error,invalid_uri,"|"}` Own Id: OTP-20235 Related Id(s): GH-7862, PR-11129 - Fixed a guard precedence bug in uri_string:compose_query/2 that caused inconsistent error handling depending on the encoding option. When `compose_query/2` was called with invalid input (e.g. an atom instead of a string) and `{encoding, unicode}`, it would crash with `** exception error: bad argument` instead of returning the expected `{error, invalid_input, Term}` tuple. The same call with `{encoding, utf8}` correctly returned the error tuple. Both encoding options now consistently return `{error, invalid_input, Term}` for invalid input. Own Id: OTP-20236 Related Id(s): PR-11128 > #### Full runtime dependencies of stdlib-8.1 > > compiler-5.0, crypto-4.5, erts-16.0.3, kernel-11.0, sasl-3.0, > syntax_tools-3.2.1 # syntax_tools-4.1.1 The syntax_tools-4.1.1 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - Fixed exception when the epp_dodger AST contains macro-named record. Own Id: OTP-20180 Related Id(s): GH-11155, PR-11203 - Any caller who passed a single syntax tree that was not a form_list (e.g. `erl_recomment:recomment_forms(erl_syntax:atom(foo), Cs)` or any expression/function tree) would get a hard crash instead of the documented result. This issue has been fixed. Own Id: OTP-20290 Related Id(s): PR-11442 > #### Full runtime dependencies of syntax_tools-4.1.1 > > compiler-9.0, erts-16.0, kernel-10.3, stdlib-8.0 # tools-4.2.3 The tools-4.2.3 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - The `tags.erl` module is used to generate `TAGS` files for Emacs. There was a case where single quote items starting in position 0 would crash the scanner. This use case can potentially happen in docstrings, although not too common. This fix makes the scanner to handle such cases instead of crashing. Own Id: OTP-20293 Related Id(s): PR-11447 - Updated the Emacs skeleton to reflect latest `format_status` callback handling. Own Id: OTP-20339 Related Id(s): PR-11507 > #### Full runtime dependencies of tools-4.2.3 > > compiler-8.5, crypto-5.9, erts-15.0, kernel-10.0, public_key-1.21, > runtime_tools-2.1, stdlib-6.0 # wx-2.7 The wx-2.7 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - A large set of correctness and robustness fixes were applied across the `wx` application, addressing issues found by static analysis of both the Erlang and C/C++ sources. Own Id: OTP-20335 Related Id(s): PR-11530 ## Improvements and New Features - Removed configure checks that prevented cross compilation of wx. Note that cross compilation is not tested and may require manual configuration. Own Id: OTP-20189 Related Id(s): PR-11137 > #### Full runtime dependencies of wx-2.7 > > erts-12.0, kernel-8.0, stdlib-5.0 # Thanks to Alois Vitasek, Anton Thomasson, ausimian, Bernhard M. Wiedemann, Cole Christensen, Dmitri Vereshchagin, Dmytro Lytovchenko, Eric Meadows-J??nsson, haoxian, Jianbo He, Jo??o Henrique Ferreira de Freitas, Johan Bevemyr, John Downey, Jonatan M??nnchen, Julian Doherty, kagetora66, k-patrik, Louis Pilfold, Lukasz Samson, Luke Bakken, Maria Scott, Mikael Pettersson, Paul Guyot, Renato Ceolin, ruslandoga, Scott Wiggins, Stanislav Yaglo, Thomas Arts, Thomas Cioppettini, Zeke Dou, zmstone From otp@REDACTED Tue Sep 22 10:03:23 2026 From: otp@REDACTED (Erlang/OTP) Date: Tue, 22 Sep 2026 10:03:23 +0200 (CEST) Subject: Patch Package OTP 29.1.1 Released Message-ID: <20260922080323.5C2952C53B@hel.cslab.ericsson.net> Patch Package: OTP 29.1.1 Git Tag: OTP-29.1.1 Date: 2026-09-22 Trouble Report Id: OTP-20272, OTP-20287, OTP-20355, OTP-20371, OTP-20386, OTP-20388, OTP-20390, OTP-20393 Seq num: CVE-2026-65634, CVE-2026-68956, CVE-2026-89422, ERIERL-1355, ERIERL-1363, GH-11586, GH-11619, GH-SA-qhcm-px9c-rvfh, PR-11523, PR-11559, PR-11616, PR-11630, PR-11638, PR-11641, PR-11651, PR-11655 System: OTP Release: 29 Application: asn1-5.5.2, compiler-10.0.6, public_key-1.21.7, ssh-6.0.6, ssl-11.7.7 Predecessor: OTP 29.1 Check out the git tag OTP-29.1.1, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below. # POTENTIAL INCOMPATIBILITIES - Fixed a vulnerability where the `max_channels` daemon option was not enforced for session channels without an active subsystem, allowing a remote authenticated user to open an infinite number of channels and exhaust server resources despite the configured limit. The default value of the max_channels daemon option has been changed from infinity to 256. Deployments requiring more than 256 simultaneous channels per connection can restore the previous behavior by setting `{max_channels, infinity}`. The default value of the max_sessions daemon option has been changed from infinity to 1024. Deployments requiring more concurrent SSH connections can restore the previous behavior by setting `{max_sessions, infinity}`. Own Id: OTP-20287 Application(s): ssh Related Id(s): GH-SA-qhcm-px9c-rvfh, PR-11523, CVE-2026-68956 # asn1-5.5.2 The asn1-5.5.2 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - Fixed a denial-of-service attack in asn1, where abnormally large OID components (arcs) could cause resource exhaustion. Own Id: OTP-20272 Related Id(s): PR-11655, CVE-2026-65634 - The JER backend will no longer break certain values (true, false, null) when they are typed as ENUMERATED, they will now be encoded as strings as required by the standard. Own Id: OTP-20355 Related Id(s): ERIERL-1355, PR-11559 > #### Full runtime dependencies of asn1-5.5.2 > > erts-14.0, kernel-9.0, stdlib-5.0 # compiler-10.0.6 The compiler-10.0.6 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - Certain uses of funs could crash the compiler. For example: f() -> F = fun Fn(0) -> 0; Fn(N) -> Fn(N - 1) end, [F(X) || X <- [1, 2]]. This has been corrected. Own Id: OTP-20386 Related Id(s): GH-11619, PR-11638 > #### Full runtime dependencies of compiler-10.0.6 > > crypto-5.1, erts-13.0, kernel-8.4, stdlib-8.0 # public_key-1.21.7 The public_key-1.21.7 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - Handle that policy qualifiers are optional. Own Id: OTP-20393 Related Id(s): PR-11630 > #### Full runtime dependencies of public_key-1.21.7 > > asn1-5.0, crypto-5.8, erts-13.0, kernel-8.0, stdlib-4.0 # ssh-6.0.6 The ssh-6.0.6 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - Fixed a vulnerability where the `max_channels` daemon option was not enforced for session channels without an active subsystem, allowing a remote authenticated user to open an infinite number of channels and exhaust server resources despite the configured limit. The default value of the max_channels daemon option has been changed from infinity to 256. Deployments requiring more than 256 simultaneous channels per connection can restore the previous behavior by setting `{max_channels, infinity}`. The default value of the max_sessions daemon option has been changed from infinity to 1024. Deployments requiring more concurrent SSH connections can restore the previous behavior by setting `{max_sessions, infinity}`. Own Id: OTP-20287 Related Id(s): GH-SA-qhcm-px9c-rvfh, PR-11523, CVE-2026-68956 *** POTENTIAL INCOMPATIBILITY *** - The SSH daemon no longer rejects a `subsystem` request that is preceded by `env` or `pty-req` request on the same channel. Own Id: OTP-20371 Related Id(s): ERIERL-1363, GH-11586, PR-11616 > #### Full runtime dependencies of ssh-6.0.6 > > crypto-5.7, erts-14.0, kernel-10.3, public_key-1.6.1, runtime_tools-1.15.1, > stdlib-8.0 # ssl-11.7.7 Note! The ssl-11.7.7 application _cannot_ be applied independently of other applications on an arbitrary OTP 29 installation. On a full OTP 29 installation, also the following runtime dependency has to be satisfied: -- public_key-1.21.1 (first satisfied in OTP 29.0.1) ## Fixed Bugs and Malfunctions - Reject unsolicited TLS-1.3 pre_shared_key in client. Own Id: OTP-20388 Related Id(s): PR-11641, CVE-2026-89422 - Security and robustness hardening returning RFC mandated alert reasons, narrowing/correcting length checks. Correct signature algorithm handling that slightly mixed up signature algorithms and signature algorithms cert in TLS-1.2. Add missing TLS-1.3 Brainpool groups support. (Not relevant in 27 patch) Enhanced/corrected documentation and spec errors/deviations. Own Id: OTP-20390 Related Id(s): PR-11651 > #### Full runtime dependencies of ssl-11.7.7 > > crypto-5.8, erts-16.0, inets-5.10.7, kernel-10.3, public_key-1.21.1, > runtime_tools-1.15.1, stdlib-7.0 # Thanks to Alan Duffield From otp@REDACTED Tue Sep 22 10:16:53 2026 From: otp@REDACTED (Erlang/OTP) Date: Tue, 22 Sep 2026 10:16:53 +0200 (CEST) Subject: Patch Package OTP 28.5.0.7 Released Message-ID: <20260922081653.A4C002C53E@hel.cslab.ericsson.net> Patch Package: OTP 28.5.0.7 Git Tag: OTP-28.5.0.7 Date: 2026-09-22 Trouble Report Id: OTP-20118, OTP-20256, OTP-20272, OTP-20287, OTP-20327, OTP-20355, OTP-20358, OTP-20365, OTP-20371, OTP-20386, OTP-20388, OTP-20390, OTP-20393 Seq num: CVE-2026-65634, CVE-2026-68956, CVE-2026-89422, ERIERL-1355, ERIERL-1356, ERIERL-1361, ERIERL-1363, GH-11338, GH-11344, GH-11534, GH-11586, GH-11619, GH-SA-qhcm-px9c-rvfh, PR-11167, PR-11356, PR-11426, PR-11523, PR-11559, PR-11566, PR-11570, PR-11616, PR-11630, PR-11638, PR-11641, PR-11651, PR-11655 System: OTP Release: 28 Application: asn1-5.4.3.1, compiler-9.0.6.3, mnesia-4.25.3.3, public_key-1.20.3.5, ssh-5.5.2.6, ssl-11.6.0.6, stdlib-7.3.0.3 Predecessor: OTP 28.5.0.6 Check out the git tag OTP-28.5.0.7, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below. # POTENTIAL INCOMPATIBILITIES - When `beam_lib` returns an error tuple, the filename in the information tuple is now a list of characters instead of an atom. Example: 1> beam_lib:chunks(code:which(lists), ["nope"]). {error,beam_lib, {missing_chunk,".../git/otp/lib/stdlib/ebin/lists.beam", "nope"}} The reason for this change is that a long file name is not guaranteed to fit in an atom. Applications or tools that do deep inspection of the `beam_lib` errors (not recommended) will need to be updated. Own Id: OTP-20118 Application(s): stdlib Related Id(s): ERIERL-1361, PR-11167 - Fixed a vulnerability where the `max_channels` daemon option was not enforced for session channels without an active subsystem, allowing a remote authenticated user to open an infinite number of channels and exhaust server resources despite the configured limit. The default value of the max_channels daemon option has been changed from infinity to 256. Deployments requiring more than 256 simultaneous channels per connection can restore the previous behavior by setting `{max_channels, infinity}`. The default value of the max_sessions daemon option has been changed from infinity to 1024. Deployments requiring more concurrent SSH connections can restore the previous behavior by setting `{max_sessions, infinity}`. Own Id: OTP-20287 Application(s): ssh Related Id(s): GH-SA-qhcm-px9c-rvfh, PR-11523, CVE-2026-68956 # asn1-5.4.3.1 The asn1-5.4.3.1 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - Fixed a denial-of-service attack in asn1, where abnormally large OID components (arcs) could cause resource exhaustion. Own Id: OTP-20272 Related Id(s): PR-11655, CVE-2026-65634 - The JER backend will no longer break certain values (true, false, null) when they are typed as ENUMERATED, they will now be encoded as strings as required by the standard. Own Id: OTP-20355 Related Id(s): ERIERL-1355, PR-11559 > #### Full runtime dependencies of asn1-5.4.3.1 > > erts-14.0, kernel-9.0, stdlib-5.0 # compiler-9.0.6.3 The compiler-9.0.6.3 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - In rare circumstances, the type analysis pass of the compiler could run for many minutes. Own Id: OTP-20365 Related Id(s): GH-11534, PR-11566 - Certain uses of funs could crash the compiler. For example: f() -> F = fun Fn(0) -> 0; Fn(N) -> Fn(N - 1) end, [F(X) || X <- [1, 2]]. This has been corrected. Own Id: OTP-20386 Related Id(s): GH-11619, PR-11638 > #### Full runtime dependencies of compiler-9.0.6.3 > > crypto-5.1, erts-13.0, kernel-8.4, stdlib-6.0 # mnesia-4.25.3.3 The mnesia-4.25.3.3 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - Fixed mnesia:force_load_table/1 getting stuck when the remote node becomes unreachable during table loading. When a network loader is aborted due to sender node going down and a user has forced a table load, we now retry loading from disc instead. Additionally, for disc_only_copies tables, the process actually loading the table is the dets server process, not the mnesia loader, so it would not receive the abort notification and would hang indefinitely. Now it correctly receives the notification and aborts table loading. Own Id: OTP-20256 Related Id(s): GH-11344, PR-11426 > #### Full runtime dependencies of mnesia-4.25.3.3 > > erts-9.0, kernel-5.3, stdlib-5.0 # public_key-1.20.3.5 Note! The public_key-1.20.3.5 application _cannot_ be applied independently of other applications on an arbitrary OTP 28 installation. On a full OTP 28 installation, also the following runtime dependency has to be satisfied: -- crypto-5.8 (first satisfied in OTP 28.3) ## Fixed Bugs and Malfunctions - Handle that policy qualifiers are optional. Own Id: OTP-20393 Related Id(s): PR-11630 > #### Full runtime dependencies of public_key-1.20.3.5 > > asn1-5.0, crypto-5.8, erts-13.0, kernel-8.0, stdlib-4.0 # ssh-5.5.2.6 Note! The ssh-5.5.2.6 application _cannot_ be applied independently of other applications on an arbitrary OTP 28 installation. On a full OTP 28 installation, also the following runtime dependency has to be satisfied: -- crypto-5.7 (first satisfied in OTP 28.1) ## Fixed Bugs and Malfunctions - Fixed a vulnerability where the `max_channels` daemon option was not enforced for session channels without an active subsystem, allowing a remote authenticated user to open an infinite number of channels and exhaust server resources despite the configured limit. The default value of the max_channels daemon option has been changed from infinity to 256. Deployments requiring more than 256 simultaneous channels per connection can restore the previous behavior by setting `{max_channels, infinity}`. The default value of the max_sessions daemon option has been changed from infinity to 1024. Deployments requiring more concurrent SSH connections can restore the previous behavior by setting `{max_sessions, infinity}`. Own Id: OTP-20287 Related Id(s): GH-SA-qhcm-px9c-rvfh, PR-11523, CVE-2026-68956 *** POTENTIAL INCOMPATIBILITY *** - The SSH daemon no longer rejects a `subsystem` request that is preceded by `env` or `pty-req` request on the same channel. Own Id: OTP-20371 Related Id(s): ERIERL-1363, GH-11586, PR-11616 > #### Full runtime dependencies of ssh-5.5.2.6 > > crypto-5.7, erts-14.0, kernel-10.3, public_key-1.6.1, runtime_tools-1.15.1, > stdlib-5.0, stdlib-6.0 # ssl-11.6.0.6 Note! The ssl-11.6.0.6 application _cannot_ be applied independently of other applications on an arbitrary OTP 28 installation. On a full OTP 28 installation, also the following runtime dependencies have to be satisfied: -- crypto-5.8 (first satisfied in OTP 28.3) -- public_key-1.20.3.1 (first satisfied in OTP 28.5.0.1) ## Fixed Bugs and Malfunctions - Undecodable `certificate_authorities` names are now skipped, as they are just a hint. Own Id: OTP-20327 Related Id(s): GH-11338, PR-11356 - Corrected generated keylog information generated from the `keylog_hs` option in the corner case that it was invoked after the client had reached its connection state, but the server closed the connection before it reached its connection state. Own Id: OTP-20358 Related Id(s): ERIERL-1356, PR-11570 - Reject unsolicited TLS-1.3 pre_shared_key in client. Own Id: OTP-20388 Related Id(s): PR-11641, CVE-2026-89422 - Security and robustness hardening returning RFC mandated alert reasons, narrowing/correcting length checks. Correct signature algorithm handling that slightly mixed up signature algorithms and signature algorithms cert in TLS-1.2. Add missing TLS-1.3 Brainpool groups support. (Not relevant in 27 patch) Enhanced/corrected documentation and spec errors/deviations. Own Id: OTP-20390 Related Id(s): PR-11651 > #### Full runtime dependencies of ssl-11.6.0.6 > > crypto-5.8, erts-16.0, inets-5.10.7, kernel-10.3, public_key-1.20.3.1, > runtime_tools-1.15.1, stdlib-7.0 # stdlib-7.3.0.3 Note! The stdlib-7.3.0.3 application _cannot_ be applied independently of other applications on an arbitrary OTP 28 installation. On a full OTP 28 installation, also the following runtime dependency has to be satisfied: -- erts-16.0.3 (first satisfied in OTP 28.0.3) ## Fixed Bugs and Malfunctions - When `beam_lib` returns an error tuple, the filename in the information tuple is now a list of characters instead of an atom. Example: 1> beam_lib:chunks(code:which(lists), ["nope"]). {error,beam_lib, {missing_chunk,".../git/otp/lib/stdlib/ebin/lists.beam", "nope"}} The reason for this change is that a long file name is not guaranteed to fit in an atom. Applications or tools that do deep inspection of the `beam_lib` errors (not recommended) will need to be updated. Own Id: OTP-20118 Related Id(s): ERIERL-1361, PR-11167 *** POTENTIAL INCOMPATIBILITY *** > #### Full runtime dependencies of stdlib-7.3.0.3 > > compiler-5.0, crypto-4.5, erts-16.0.3, kernel-10.0, sasl-3.0, > syntax_tools-3.2.1 # Thanks to Alan Duffield, ausimian From otp@REDACTED Tue Sep 22 10:33:12 2026 From: otp@REDACTED (Erlang/OTP) Date: Tue, 22 Sep 2026 10:33:12 +0200 (CEST) Subject: Patch Package OTP 27.3.4.18 Released Message-ID: <20260922083312.D6B8D2C543@hel.cslab.ericsson.net> Patch Package: OTP 27.3.4.18 Git Tag: OTP-27.3.4.18 Date: 2026-09-22 Trouble Report Id: OTP-20256, OTP-20272, OTP-20287, OTP-20327, OTP-20355, OTP-20358, OTP-20365, OTP-20367, OTP-20371, OTP-20384, OTP-20386, OTP-20388, OTP-20390 Seq num: CVE-2026-65634, CVE-2026-68956, CVE-2026-89422, ERIERL-1355, ERIERL-1356, ERIERL-1363, GH-11338, GH-11344, GH-11534, GH-11586, GH-11619, GH-SA-qhcm-px9c-rvfh, PR-11356, PR-11426, PR-11523, PR-11559, PR-11566, PR-11570, PR-11574, PR-11616, PR-11632, PR-11638, PR-11641, PR-11651, PR-11655 System: OTP Release: 27 Application: asn1-5.3.4.3, compiler-8.6.1.7, mnesia-4.23.5.5, public_key-1.17.1.6, ssh-5.2.11.13, ssl-11.2.12.13 Predecessor: OTP 27.3.4.17 Check out the git tag OTP-27.3.4.18, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below. # POTENTIAL INCOMPATIBILITIES - Fixed a vulnerability where the `max_channels` daemon option was not enforced for session channels without an active subsystem, allowing a remote authenticated user to open an infinite number of channels and exhaust server resources despite the configured limit. The default value of the max_channels daemon option has been changed from infinity to 256. Deployments requiring more than 256 simultaneous channels per connection can restore the previous behavior by setting `{max_channels, infinity}`. The default value of the max_sessions daemon option has been changed from infinity to 1024. Deployments requiring more concurrent SSH connections can restore the previous behavior by setting `{max_sessions, infinity}`. Own Id: OTP-20287 Application(s): ssh Related Id(s): GH-SA-qhcm-px9c-rvfh, PR-11523, CVE-2026-68956 # asn1-5.3.4.3 The asn1-5.3.4.3 application can be applied independently of other applications on a full OTP 27 installation. ## Fixed Bugs and Malfunctions - Fixed a denial-of-service attack in asn1, where abnormally large OID components (arcs) could cause resource exhaustion. Own Id: OTP-20272 Related Id(s): PR-11655, CVE-2026-65634 - The JER backend will no longer break certain values (true, false, null) when they are typed as ENUMERATED, they will now be encoded as strings as required by the standard. Own Id: OTP-20355 Related Id(s): ERIERL-1355, PR-11559 > #### Full runtime dependencies of asn1-5.3.4.3 > > erts-14.0, kernel-9.0, stdlib-5.0 # compiler-8.6.1.7 The compiler-8.6.1.7 application can be applied independently of other applications on a full OTP 27 installation. ## Fixed Bugs and Malfunctions - In rare circumstances, the type analysis pass of the compiler could run for many minutes. Own Id: OTP-20365 Related Id(s): GH-11534, PR-11566 - Certain uses of funs could crash the compiler. For example: f() -> F = fun Fn(0) -> 0; Fn(N) -> Fn(N - 1) end, [F(X) || X <- [1, 2]]. This has been corrected. Own Id: OTP-20386 Related Id(s): GH-11619, PR-11638 > #### Full runtime dependencies of compiler-8.6.1.7 > > crypto-5.1, erts-13.0, kernel-8.4, stdlib-6.0 # mnesia-4.23.5.5 The mnesia-4.23.5.5 application can be applied independently of other applications on a full OTP 27 installation. ## Fixed Bugs and Malfunctions - Fixed mnesia:force_load_table/1 getting stuck when the remote node becomes unreachable during table loading. When a network loader is aborted due to sender node going down and a user has forced a table load, we now retry loading from disc instead. Additionally, for disc_only_copies tables, the process actually loading the table is the dets server process, not the mnesia loader, so it would not receive the abort notification and would hang indefinitely. Now it correctly receives the notification and aborts table loading. Own Id: OTP-20256 Related Id(s): GH-11344, PR-11426 > #### Full runtime dependencies of mnesia-4.23.5.5 > > erts-9.0, kernel-5.3, stdlib-5.0 # public_key-1.17.1.6 The public_key-1.17.1.6 application can be applied independently of other applications on a full OTP 27 installation. ## Fixed Bugs and Malfunctions - Align moduli and pubkey_moduli.hrl to state on OTP-28 and newer. Own Id: OTP-20367 Related Id(s): PR-11574 > #### Full runtime dependencies of public_key-1.17.1.6 > > asn1-5.0, crypto-5.0, erts-13.0, kernel-8.0, stdlib-4.0 # ssh-5.2.11.13 The ssh-5.2.11.13 application can be applied independently of other applications on a full OTP 27 installation. ## Fixed Bugs and Malfunctions - Fixed a vulnerability where the `max_channels` daemon option was not enforced for session channels without an active subsystem, allowing a remote authenticated user to open an infinite number of channels and exhaust server resources despite the configured limit. The default value of the max_channels daemon option has been changed from infinity to 256. Deployments requiring more than 256 simultaneous channels per connection can restore the previous behavior by setting `{max_channels, infinity}`. The default value of the max_sessions daemon option has been changed from infinity to 1024. Deployments requiring more concurrent SSH connections can restore the previous behavior by setting `{max_sessions, infinity}`. Own Id: OTP-20287 Related Id(s): GH-SA-qhcm-px9c-rvfh, PR-11523, CVE-2026-68956 *** POTENTIAL INCOMPATIBILITY *** - The SSH daemon no longer rejects a `subsystem` request that is preceded by `env` or `pty-req` request on the same channel. Own Id: OTP-20371 Related Id(s): ERIERL-1363, GH-11586, PR-11616 > #### Full runtime dependencies of ssh-5.2.11.13 > > crypto-5.0, erts-14.0, kernel-9.0, public_key-1.6.1, runtime_tools-1.15.1, > stdlib-5.0, stdlib-6.0 # ssl-11.2.12.13 Note! The ssl-11.2.12.13 application _cannot_ be applied independently of other applications on an arbitrary OTP 27 installation. On a full OTP 27 installation, also the following runtime dependency has to be satisfied: -- public_key-1.17.1.3 (first satisfied in OTP 27.3.4.12) ## Fixed Bugs and Malfunctions - Undecodable `certificate_authorities` names are now skipped, as they are just a hint. Own Id: OTP-20327 Related Id(s): GH-11338, PR-11356 - Corrected generated keylog information generated from the `keylog_hs` option in the corner case that it was invoked after the client had reached its connection state, but the server closed the connection before it reached its connection state. Own Id: OTP-20358 Related Id(s): ERIERL-1356, PR-11570 - Fix restart bug for TLS-1.3 session ticket server, introduced by backport commit in OTP-27.3.4.14, would case a restart to fail due to wrong number of arguments. Own Id: OTP-20384 Related Id(s): PR-11632 - Reject unsolicited TLS-1.3 pre_shared_key in client. Own Id: OTP-20388 Related Id(s): PR-11641, CVE-2026-89422 - Security and robustness hardening returning RFC mandated alert reasons, narrowing/correcting length checks. Correct signature algorithm handling that slightly mixed up signature algorithms and signature algorithms cert in TLS-1.2. Add missing TLS-1.3 Brainpool groups support. (Not relevant in 27 patch) Enhanced/corrected documentation and spec errors/deviations. Own Id: OTP-20390 Related Id(s): PR-11651 > #### Full runtime dependencies of ssl-11.2.12.13 > > crypto-5.1, erts-15.0, inets-5.10.7, kernel-9.0, public_key-1.17.1.3, > runtime_tools-1.15.1, stdlib-6.0 # Thanks to Alex Nogueira, ausimian