From otp@REDACTED  Tue Sep  1 14:08:39 2026
From: otp@REDACTED (Erlang/OTP)
Date: Tue, 01 Sep 2026 14:08:39 +0200 (CEST)
Subject: Patch Package OTP 29.0.6 Released
Message-ID: <20260901120839.7FB472C538@hel.cslab.ericsson.net>

Patch Package:           OTP 29.0.6
Git Tag:                 OTP-29.0.6
Date:                    2026-09-01
Trouble Report Id:       OTP-20135, OTP-20234, OTP-20264, OTP-20268,
                         OTP-20269, OTP-20270, OTP-20271, OTP-20274,
                         OTP-20278, OTP-20279, OTP-20281, OTP-20282,
                         OTP-20284, OTP-20286, OTP-20289, OTP-20296,
                         OTP-20300, OTP-20301, OTP-20302, OTP-20306,
                         OTP-20307, OTP-20308, OTP-20312, OTP-20319,
                         OTP-20321, OTP-20324, OTP-20330, OTP-20333,
                         OTP-20334, OTP-20342, OTP-20343, OTP-20344,
                         OTP-20345, OTP-20346, OTP-20347, OTP-20350,
                         OTP-20351
Seq num:                 CVE-2026-75538, ERIERL-1345, ERIERL-1354,
                         GH-11052, GH-11240, GH-11278, GH-11380,
                         GH-11404, GH-11416, GH-11419, GH-11494,
                         GH-11511, PR-11298, PR-11325, PR-11358,
                         PR-11417, PR-11425, PR-11428, PR-11429,
                         PR-11437, PR-11463, PR-11464, PR-11470,
                         PR-11478, PR-11481, PR-11485, PR-11492,
                         PR-11503, PR-11509, PR-11513, PR-11517,
                         PR-11521, PR-11533, PR-11538, PR-11539,
                         PR-11540, PR-11541, PR-11542, PR-11543,
                         PR-11544, PR-11545, PR-11546, PR-11547,
                         PR-11548, PR-11553, PR-11554
System:                  OTP
Release:                 29
Application:             compiler-10.0.4, crypto-5.9.3, eldap-1.3.1,
                         erl_interface-5.8.2, erts-17.0.6,
                         inets-9.7.2, megaco-4.9.2, mnesia-4.26.2,
                         public_key-1.21.5, snmp-5.20.5, ssh-6.0.5,
                         ssl-11.7.5, stdlib-8.0.4, tools-4.2.2
Predecessor:             OTP 29.0.5

Check out the git tag OTP-29.0.6, and build a full OTP system including
documentation. Apply one or more applications from this build as patches to your
installation using the 'otp_patch_apply' tool. For information on install
requirements, see descriptions for each application version below.

# compiler-10.0.4

The compiler-10.0.4 application can be applied independently of other
applications on a full OTP 29 installation.

## Fixed Bugs and Malfunctions

- compiler: Fix bug in beam_types:subtract/2 for bitstrings

  Own Id: OTP-20312
  Related Id(s): GH-11494, PR-11503

> #### Full runtime dependencies of compiler-10.0.4
>
> crypto-5.1, erts-13.0, kernel-8.4, stdlib-8.0

# crypto-5.9.3

The crypto-5.9.3 application can be applied independently of other applications
on a full OTP 29 installation.

## Fixed Bugs and Malfunctions

- Fixed type mismatch between `ErlNifUInt64` and `uint64_t` in crypto NIF that
  caused incompatible-pointer warnings on macOS arm64 when passing DH parameters
  to OpenSSL.

  Own Id: OTP-20333
  Related Id(s): GH-11511, PR-11513

> #### Full runtime dependencies of crypto-5.9.3
>
> erts-9.0, kernel-6.0, stdlib-3.9

# eldap-1.3.1

The eldap-1.3.1 application can be applied independently of other applications
on a full OTP 29 installation.

## Fixed Bugs and Malfunctions

- eldap referral URL parsing now rejects a port component longer than 5 digits
  instead of attempting to convert an arbitrarily large digit string to an
  integer.

  Own Id: OTP-20345
  Related Id(s): PR-11538

> #### Full runtime dependencies of eldap-1.3.1
>
> asn1-3.0, erts-6.0, kernel-3.0, ssl-5.3.4, stdlib-3.4

# erl_interface-5.8.2

The erl_interface-5.8.2 application can be applied independently of other
applications on a full OTP 29 installation.

## Fixed Bugs and Malfunctions

- erl_interface: Fix buffer leak and state corruption on `ei_x_buff` realloc
  failure

  Own Id: OTP-20324
  Related Id(s): PR-11492

# erts-17.0.6

The erts-17.0.6 application can be applied independently of other applications
on a full OTP 29 installation.

## Fixed Bugs and Malfunctions

- No-suspend port command signals (i.e. port command signals sent using the
  erlang:port_command/3 BIF or the erlang:send/3 BIF with the `nosuspend`
  option) were not aborted properly in all scenarios which could leave the port
  queue in a busy state indefinitely. Also asynchronously sent no-suspend
  command signals (i.e, port command signals sent using the erlang:send/3 BIF
  with the `nosuspend` option) could sometimes be delivered even though the port
  was busy.

  Own Id: OTP-20135
  Related Id(s): GH-11052, PR-11463

- erts: Fix missing exit_status caused by SIGCHLD race

  Own Id: OTP-20274
  Related Id(s): GH-11278, PR-11298

- erts: Fix bug in `is_in_range` instruction for x86 JIT

  Own Id: OTP-20278
  Related Id(s): GH-11419, PR-11429

- Fixed bug in `binary_to_term` that could cause emulator crash for specific
  terms in specific process states (reductions left).

  Own Id: OTP-20281
  Related Id(s): GH-11404, PR-11425

- erts: Fix crash with `term_to_iovec/2` for large binary

  Own Id: OTP-20282
  Related Id(s): PR-11428

- A distributed `priority` send larger than 32 KiB to a process alias caused the
  receiving runtime system to crash.

  Own Id: OTP-20286
  Related Id(s): GH-11416, PR-11417

- Priority message queue markers were sometimes installed in the message queue
  even when no priority messages could be received. As a result, the two markers
  had to be traversed unnecessarily when scanning the message queue, introducing
  a small but avoidable overhead.

  Own Id: OTP-20300
  Related Id(s): PR-11485

- A monitor of `time_offset` co-created with a process alias
  (`monitor(time_offset, clock_service, {alias, UnaliasOpt})`) either crashed
  the runtime system or did not work. This bug was introduced in OTP 25.0.

  Own Id: OTP-20319
  Related Id(s): PR-11509

- A process alias was erroneously created when a remote `spawn_request()`
  operation with a `{monitor, {alias, explicit_unalias}}` option failed with
  `noconnection` reason.

  Own Id: OTP-20330
  Related Id(s): PR-11521

- A `gen_tcp` socket using the inet driver and `{packet,4}` had a bug if
  receiving a packet with size just below INT_MAX.

  That packet size wrapped in size calculations and made the received data
  overwrite its allocation and trash allocator metadata and subsequent block(s),
  causing the VM to crash.

  This made it possible for anyone to remotely crash an Erlang node that used
  `{packet,4}` on a reachable socket.

  This bug has been corrected.

  Own Id: OTP-20334
  Related Id(s): PR-11533, CVE-2026-75538

> #### Full runtime dependencies of erts-17.0.6
>
> kernel-9.0, sasl-3.3, stdlib-4.1

# inets-9.7.2

The inets-9.7.2 application can be applied independently of other applications
on a full OTP 29 installation.

## Fixed Bugs and Malfunctions

- The `dets` and `mnesia` `mod_auth` backends used a key that did not include
  the directory path, so all `require_user`/`require_group` records collapsed
  into one per-listener namespace. A user authorized for one protected directory
  could authenticate against any other protected directory served by the same
  listener. `{path, Directory}` is now included in the auth backend key, scoping
  records per directory as documented.

  Own Id: OTP-20264
  Related Id(s): PR-11546

- Requests specifying both `Transfer-Encoding` and `Content-Length` headers are
  now rejected with `400 Bad Request`, per RFC 9112 Section 6.3. Previously such
  requests could be used for CL.TE request-smuggling/desync attacks against
  reverse proxies in front of `httpd`.

  Own Id: OTP-20268
  Related Id(s): PR-11547

- `httpd` accepted the obsolete header line-folding syntax (RFC 9112 Section
  5.2, a continuation line beginning with space/tab), silently treating the
  folded continuation as a separate header. This allowed CL.TE-style request
  smuggling when `httpd` was placed behind a folding-aware proxy. Such requests
  are now rejected with `400 Bad Request`.

  Own Id: OTP-20269
  Related Id(s): PR-11544

- A header such as `Content-Length : 6` (whitespace before the colon) was
  previously silently dropped, causing the content length to default to 0 and
  the body bytes to be misinterpreted as a pipelined request (CL.0 smuggling).
  Per RFC 7230 Section 3.2.4, such headers are now rejected with
  `400 Bad Request`.

  Own Id: OTP-20270
  Related Id(s): PR-11545

- A new httpd option `request_timeout` (default 60 seconds, renamed from the
  interim `max_body_read_timeout`) bounds the idle time between reads of a
  request body/message. The server now also sends `408 Request Timeout` when the
  `min_bytes_per_second` floor is hit, and `keep_alive_timeout` measurement was
  corrected so the timer is cancelled as soon as new data arrives rather than
  only after full header parsing; `keep_alive_timeout` and `request_timeout` now
  also accept `infinity` to disable the timeout.

  Own Id: OTP-20271
  Related Id(s): PR-11543

- `mod_auth`, `mod_security`, and `mod_get` compared resolved filesystem paths
  against configured protected-directory patterns without normalizing repeated
  slashes or filesystem case. On case-insensitive filesystems (macOS, Windows)
  or with repeated slashes, a request could resolve to a protected resource
  while evading the directory match. Paths are now canonicalized
  (slash-collapsed, and case-normalized when the filesystem is case-insensitive)
  before the authorization decision.

  Own Id: OTP-20279
  Related Id(s): PR-11542

- A request with an invalid chunked transfer-encoding chunk size previously
  caused the httpd connection handler to hang indefinitely without requiring
  further input from the client. This leaked a process per request and could be
  used to exhaust server resources (denial of service). Invalid chunk sizes are
  now rejected immediately with an error response, and the connection is closed.

  Own Id: OTP-20306
  Related Id(s): PR-11539

- `max_body_size` was previously enforced only after a complete chunk had been
  received, allowing a single oversized chunk to be buffered in full before the
  limit was checked ??? undermining the memory-exhaustion protection the option is
  meant to provide. The limit is now enforced incrementally as chunk data
  arrives, rejecting the request as soon as the configured size is exceeded.

  Own Id: OTP-20307
  Related Id(s): PR-11540

- The documented default of 150 for the `max_clients` option was not applied by
  the implementation, allowing an unbounded number of concurrent clients to
  connect regardless of configuration. The default is now correctly enforced.

  Own Id: OTP-20308
  Related Id(s): PR-11541

- Fixed a bug where httpd failed to start when configured with {socket_type,
  {ip_comm, SockOpts}} and a fixed (non-zero) port.

  Own Id: OTP-20342
  Related Id(s): PR-11548

- `httpc` now enforces a limit on the total size of response headers and
  response body, preventing unbounded memory allocation when connecting to a
  malicious or malfunctioning server. The new max_header_size and max_body_size
  request options can be used to override the default limit (10240 bytes for
  headers). Additionally, httpc now validates that the Content-Length header
  contains only digits before use, avoiding a crash on malformed responses.

  Own Id: OTP-20343
  Related Id(s): PR-11538

> #### Full runtime dependencies of inets-9.7.2
>
> erts-14.0, kernel-9.0, mnesia-4.12, public_key-1.13, runtime_tools-1.8.14,
> ssl-9.0, stdlib-5.0, stdlib-6.0

# megaco-4.9.2

The megaco-4.9.2 application can be applied independently of other applications
on a full OTP 29 installation.

## Fixed Bugs and Malfunctions

- Numeric fields in megaco text-encoded messages are now validated for
  digit-string length before integer conversion, improving robustness of the
  text decoder. Per-field digit limits based on the H.248.1 ASN.1 type
  constraints are enforced (e.g., 10 digits for UINT32, 2 digits for timer
  values), along with a 100 KB overall message size cap at the scanner entry
  point. The binary (BER/PER) codec is not affected.

  Own Id: OTP-20234
  Related Id(s): PR-11325

> #### Full runtime dependencies of megaco-4.9.2
>
> asn1-3.0, debugger-4.0, erts-12.0, et-1.5, kernel-8.0, runtime_tools-1.8.14,
> stdlib-2.5

# mnesia-4.26.2

The mnesia-4.26.2 application can be applied independently of other applications
on a full OTP 29 installation.

## Fixed Bugs and Malfunctions

- A transaction iterating a table (first/1, last/1, next/2, prev/2, select,
  select_reverse on non-ordered_set) leaked a safe_fixtable hold when the
  coordinator was killed by an external signal. The table remained fixed for the
  lifetime of the node, preventing space reclamation of deleted objects.

  Own Id: OTP-20347
  Related Id(s): PR-11517

- Fixed a race condition where mnesia_controller could crash if a table was
  deleted while mnesia:set_master_nodes/2 was being processed.

  Own Id: OTP-20351
  Related Id(s): PR-11554

> #### Full runtime dependencies of mnesia-4.26.2
>
> erts-9.0, kernel-5.3, stdlib-5.0

# public_key-1.21.5

The public_key-1.21.5 application can be applied independently of other
applications on a full OTP 29 installation.

## Fixed Bugs and Malfunctions

- Retain lost CommonName length relaxation.

  Own Id: OTP-20321
  Related Id(s): GH-11240, PR-11358

> #### Full runtime dependencies of public_key-1.21.5
>
> asn1-5.0, crypto-5.8, erts-13.0, kernel-8.0, stdlib-4.0

# snmp-5.20.5

The snmp-5.20.5 application can be applied independently of other applications
on a full OTP 29 installation.

## Fixed Bugs and Malfunctions

- The SNMP PDU decoder now bounds the byte length accepted for INTEGER,
  Counter32, Gauge32/Unsigned32, TimeTicks, and Counter64 values during decoding
  (4, 5, 5, 5, and 9 bytes respectively, matching the SMIv2 value ranges),
  instead of accepting an arbitrarily large byte string and converting it to an
  integer.

  Own Id: OTP-20346
  Related Id(s): PR-11538

> #### Full runtime dependencies of snmp-5.20.5
>
> asn1-5.4, crypto-4.6, erts-12.0, kernel-8.0, mnesia-4.12,
> runtime_tools-1.8.14, stdlib-5.0

# ssh-6.0.5

The ssh-6.0.5 application can be applied independently of other applications on
a full OTP 29 installation.

## Fixed Bugs and Malfunctions

- Fixed a bug where multiple subsystem requests could succeed on same ssh
  channel which is forbidden by RFC 4254 ??6.5

  Own Id: OTP-20284
  Related Id(s): PR-11437

> #### Full runtime dependencies of ssh-6.0.5
>
> crypto-5.7, erts-14.0, kernel-10.3, public_key-1.6.1, runtime_tools-1.15.1,
> stdlib-8.0

# ssl-11.7.5

Note! The ssl-11.7.5 application _cannot_ be applied independently of other
applications on an arbitrary OTP 29 installation.

       On a full OTP 29 installation, also the following runtime
       dependency has to be satisfied:
       -- public_key-1.21.1 (first satisfied in OTP 29.0.1)

## Fixed Bugs and Malfunctions

- Debugging keylog_hs callback used for logging handshake secrets on failed
  connections swapped the argument order in logging function confusing server
  and client side. The bug was introduced in OTP 28.5

  Own Id: OTP-20350
  Related Id(s): ERIERL-1354, PR-11553

## Improvements and New Features

- Hardening improvements of the ssl application.

  TLS distribution now defaults to TLS-1.3 instead of TLS-1.2 (TLS-1.2 is kept
  as fallback for rolling upgrades).

  TLS-1.2 server with {verify, verify_peer} now defaults reuse_sessions to false
  to mitigate the Triple Handshake attack (RFC 7627). Set {reuse_sessions, true}
  explicitly to restore previous behavior.

  Various missing or faulty sanity checks added and TLS alerts adjusted to
  comply with RFC MUST requirements, including: signature algorithm validation
  for intermediate certificates, TLS-1.3 session_id echo, pre_shared_key
  extension ordering, and renegotiation_info enforcement.

  Hardened and improved CRL support. Introduces new option allowed_hosts for the
  optional CRL HTTP fetching feature to restrict which hosts may be contacted.
  Internal/loopback IPs are now blocked by default (SSRF protection).

  TLS-1.3 client ticket handling is more robust (locked tickets are released on
  client crash). Server TLS-1.3 ticket handling and anti-replay Bloom filter
  performance are optimized.

  DTLS duplicate ChangeCipherSpec handling simplified, fixing potential state
  machine confusion (GH-11075).

  Process state formatting no longer leaks secrets in crash logs.

  Own Id: OTP-20289
  Related Id(s): PR-11478

> #### Full runtime dependencies of ssl-11.7.5
>
> crypto-5.8, erts-16.0, inets-5.10.7, kernel-10.3, public_key-1.21.1,
> runtime_tools-1.15.1, stdlib-7.0

# stdlib-8.0.4

The stdlib-8.0.4 application can be applied independently of other applications
on a full OTP 29 installation.

## Fixed Bugs and Malfunctions

- Fixed a bug in unicode_util:gc/1 where the grapheme cluster segmentation of
  `$\r` (not followed by `$\n`) would decompose binary continuations into mixed
  chardata. This caused string:trim/3 (and string:chomp/1) to return
  incorrect results or crash when trimming strings containing binaries followed
  by another list element.

  Own Id: OTP-20296
  Related Id(s): GH-11380, PR-11464

- `record_info/2` will now mark tuple records as used.

  Own Id: OTP-20301
  Related Id(s): ERIERL-1345, PR-11470

- uri_string:parse/1 now rejects URIs with an unreasonably long port component
  (more than 5 digits) instead of attempting to convert an arbitrarily large
  digit string to an integer.

  Own Id: OTP-20344
  Related Id(s): PR-11538

> #### Full runtime dependencies of stdlib-8.0.4
>
> compiler-5.0, crypto-4.5, erts-16.0.3, kernel-11.0, sasl-3.0,
> syntax_tools-3.2.1

# tools-4.2.2

The tools-4.2.2 application can be applied independently of other applications
on a full OTP 29 installation.

## Fixed Bugs and Malfunctions

- tools: fixes tprof not stopping tracing

  A call to `tprof:enable_trace(new|existing)` starts tracing processes. To stop
  it, one calls `tprof:disable_trace(new|existing)`. However, the guard to stop
  tracing was matching on `new_processes | existing_processes`. The return
  happens to say `0` processes are traced now, but the tracing did not stop.
  This issue has been fixed.

  Own Id: OTP-20302
  Related Id(s): PR-11481

> #### Full runtime dependencies of tools-4.2.2
>
> compiler-8.5, crypto-5.9, erts-15.0, kernel-10.0, public_key-1.21,
> runtime_tools-2.1, stdlib-6.0

# Thanks to

Andrew Bennett, ausimian, Laurynas ??etyrkinas, ruslandoga, Thomas Cioppettini


From otp@REDACTED  Tue Sep  1 14:35:21 2026
From: otp@REDACTED (Erlang/OTP)
Date: Tue, 01 Sep 2026 14:35:21 +0200 (CEST)
Subject: Patch Package OTP 28.5.0.6 Released
Message-ID: <20260901123521.14E062C53D@hel.cslab.ericsson.net>

Patch Package:           OTP 28.5.0.6
Git Tag:                 OTP-28.5.0.6
Date:                    2026-09-01
Trouble Report Id:       OTP-20135, OTP-20234, OTP-20264, OTP-20265,
                         OTP-20268, OTP-20269, OTP-20270, OTP-20271,
                         OTP-20274, OTP-20278, OTP-20279, OTP-20281,
                         OTP-20282, OTP-20284, OTP-20286, OTP-20289,
                         OTP-20296, OTP-20300, OTP-20302, OTP-20306,
                         OTP-20307, OTP-20308, OTP-20312, OTP-20319,
                         OTP-20320, OTP-20324, OTP-20330, OTP-20333,
                         OTP-20334, OTP-20342, OTP-20343, OTP-20344,
                         OTP-20345, OTP-20346, OTP-20347, OTP-20350,
                         OTP-20351
Seq num:                 CVE-2026-75538, ERIERL-1354, GH-11052,
                         GH-11278, GH-11308, GH-11380, GH-11404,
                         GH-11416, GH-11419, GH-11423, GH-11494,
                         GH-11511, PR-11298, PR-11325, PR-11388,
                         PR-11417, PR-11425, PR-11428, PR-11429,
                         PR-11437, PR-11463, PR-11464, PR-11478,
                         PR-11481, PR-11485, PR-11492, PR-11503,
                         PR-11505, PR-11509, PR-11513, PR-11517,
                         PR-11521, PR-11533, PR-11538, PR-11539,
                         PR-11540, PR-11541, PR-11542, PR-11543,
                         PR-11544, PR-11545, PR-11546, PR-11547,
                         PR-11548, PR-11553, PR-11554
System:                  OTP
Release:                 28
Application:             compiler-9.0.6.2, crypto-5.8.3.3,
                         eldap-1.2.16.1, erl_interface-5.7.0.2,
                         erts-16.4.0.6, inets-9.6.2.3,
                         kernel-10.6.3.4, megaco-4.8.3.2,
                         mnesia-4.25.3.2, snmp-5.20.2.2, ssh-5.5.2.5,
                         ssl-11.6.0.5, stdlib-7.3.0.2, tools-4.1.4.1
Predecessor:             OTP 28.5.0.5

Check out the git tag OTP-28.5.0.6, and build a full OTP system including
documentation. Apply one or more applications from this build as patches to your
installation using the 'otp_patch_apply' tool. For information on install
requirements, see descriptions for each application version below.

# compiler-9.0.6.2

The compiler-9.0.6.2 application can be applied independently of other
applications on a full OTP 28 installation.

## Fixed Bugs and Malfunctions

- compiler: Fix bug in beam_types:subtract/2 for bitstrings

  Own Id: OTP-20312
  Related Id(s): GH-11494, PR-11503

> #### Full runtime dependencies of compiler-9.0.6.2
>
> crypto-5.1, erts-13.0, kernel-8.4, stdlib-6.0

# crypto-5.8.3.3

The crypto-5.8.3.3 application can be applied independently of other
applications on a full OTP 28 installation.

## Fixed Bugs and Malfunctions

- Fixed type mismatch between `ErlNifUInt64` and `uint64_t` in crypto NIF that
  caused incompatible-pointer warnings on macOS arm64 when passing DH parameters
  to OpenSSL.

  Own Id: OTP-20333
  Related Id(s): GH-11511, PR-11513

> #### Full runtime dependencies of crypto-5.8.3.3
>
> erts-9.0, kernel-6.0, stdlib-3.9

# eldap-1.2.16.1

The eldap-1.2.16.1 application can be applied independently of other
applications on a full OTP 28 installation.

## Fixed Bugs and Malfunctions

- eldap referral URL parsing now rejects a port component longer than 5 digits
  instead of attempting to convert an arbitrarily large digit string to an
  integer.

  Own Id: OTP-20345
  Related Id(s): PR-11538

> #### Full runtime dependencies of eldap-1.2.16.1
>
> asn1-3.0, erts-6.0, kernel-3.0, ssl-5.3.4, stdlib-3.4

# erl_interface-5.7.0.2

The erl_interface-5.7.0.2 application can be applied independently of other
applications on a full OTP 28 installation.

## Fixed Bugs and Malfunctions

- erl_interface: Fix buffer leak and state corruption on `ei_x_buff` realloc
  failure

  Own Id: OTP-20324
  Related Id(s): PR-11492

# erts-16.4.0.6

The erts-16.4.0.6 application can be applied independently of other applications
on a full OTP 28 installation.

## Fixed Bugs and Malfunctions

- No-suspend port command signals (i.e. port command signals sent using the
  erlang:port_command/3 BIF or the erlang:send/3 BIF with the `nosuspend`
  option) were not aborted properly in all scenarios which could leave the port
  queue in a busy state indefinitely. Also asynchronously sent no-suspend
  command signals (i.e, port command signals sent using the erlang:send/3 BIF
  with the `nosuspend` option) could sometimes be delivered even though the port
  was busy.

  Own Id: OTP-20135
  Related Id(s): GH-11052, PR-11463

- erts: Fix missing exit_status caused by SIGCHLD race

  Own Id: OTP-20274
  Related Id(s): GH-11278, PR-11298

- erts: Fix bug in `is_in_range` instruction for x86 JIT

  Own Id: OTP-20278
  Related Id(s): GH-11419, PR-11429

- Fixed bug in `binary_to_term` that could cause emulator crash for specific
  terms in specific process states (reductions left).

  Own Id: OTP-20281
  Related Id(s): GH-11404, PR-11425

- erts: Fix crash with `term_to_iovec/2` for large binary

  Own Id: OTP-20282
  Related Id(s): PR-11428

- A distributed `priority` send larger than 32 KiB to a process alias caused the
  receiving runtime system to crash.

  Own Id: OTP-20286
  Related Id(s): GH-11416, PR-11417

- Priority message queue markers were sometimes installed in the message queue
  even when no priority messages could be received. As a result, the two markers
  had to be traversed unnecessarily when scanning the message queue, introducing
  a small but avoidable overhead.

  Own Id: OTP-20300
  Related Id(s): PR-11485

- A monitor of `time_offset` co-created with a process alias
  (`monitor(time_offset, clock_service, {alias, UnaliasOpt})`) either crashed
  the runtime system or did not work. This bug was introduced in OTP 25.0.

  Own Id: OTP-20319
  Related Id(s): PR-11509

- A process alias was erroneously created when a remote `spawn_request()`
  operation with a `{monitor, {alias, explicit_unalias}}` option failed with
  `noconnection` reason.

  Own Id: OTP-20330
  Related Id(s): PR-11521

- A `gen_tcp` socket using the inet driver and `{packet,4}` had a bug if
  receiving a packet with size just below INT_MAX.

  That packet size wrapped in size calculations and made the received data
  overwrite its allocation and trash allocator metadata and subsequent block(s),
  causing the VM to crash.

  This made it possible for anyone to remotely crash an Erlang node that used
  `{packet,4}` on a reachable socket.

  This bug has been corrected.

  Own Id: OTP-20334
  Related Id(s): PR-11533, CVE-2026-75538

> #### Full runtime dependencies of erts-16.4.0.6
>
> kernel-9.0, sasl-3.3, stdlib-4.1

# inets-9.6.2.3

The inets-9.6.2.3 application can be applied independently of other applications
on a full OTP 28 installation.

## Fixed Bugs and Malfunctions

- The `dets` and `mnesia` `mod_auth` backends used a key that did not include
  the directory path, so all `require_user`/`require_group` records collapsed
  into one per-listener namespace. A user authorized for one protected directory
  could authenticate against any other protected directory served by the same
  listener. `{path, Directory}` is now included in the auth backend key, scoping
  records per directory as documented.

  Own Id: OTP-20264
  Related Id(s): PR-11546

- Requests specifying both `Transfer-Encoding` and `Content-Length` headers are
  now rejected with `400 Bad Request`, per RFC 9112 Section 6.3. Previously such
  requests could be used for CL.TE request-smuggling/desync attacks against
  reverse proxies in front of `httpd`.

  Own Id: OTP-20268
  Related Id(s): PR-11547

- `httpd` accepted the obsolete header line-folding syntax (RFC 9112 Section
  5.2, a continuation line beginning with space/tab), silently treating the
  folded continuation as a separate header. This allowed CL.TE-style request
  smuggling when `httpd` was placed behind a folding-aware proxy. Such requests
  are now rejected with `400 Bad Request`.

  Own Id: OTP-20269
  Related Id(s): PR-11544

- A header such as `Content-Length : 6` (whitespace before the colon) was
  previously silently dropped, causing the content length to default to 0 and
  the body bytes to be misinterpreted as a pipelined request (CL.0 smuggling).
  Per RFC 7230 Section 3.2.4, such headers are now rejected with
  `400 Bad Request`.

  Own Id: OTP-20270
  Related Id(s): PR-11545

- A new httpd option `request_timeout` (default 60 seconds, renamed from the
  interim `max_body_read_timeout`) bounds the idle time between reads of a
  request body/message. The server now also sends `408 Request Timeout` when the
  `min_bytes_per_second` floor is hit, and `keep_alive_timeout` measurement was
  corrected so the timer is cancelled as soon as new data arrives rather than
  only after full header parsing; `keep_alive_timeout` and `request_timeout` now
  also accept `infinity` to disable the timeout.

  Own Id: OTP-20271
  Related Id(s): PR-11543

- `mod_auth`, `mod_security`, and `mod_get` compared resolved filesystem paths
  against configured protected-directory patterns without normalizing repeated
  slashes or filesystem case. On case-insensitive filesystems (macOS, Windows)
  or with repeated slashes, a request could resolve to a protected resource
  while evading the directory match. Paths are now canonicalized
  (slash-collapsed, and case-normalized when the filesystem is case-insensitive)
  before the authorization decision.

  Own Id: OTP-20279
  Related Id(s): PR-11542

- A request with an invalid chunked transfer-encoding chunk size previously
  caused the httpd connection handler to hang indefinitely without requiring
  further input from the client. This leaked a process per request and could be
  used to exhaust server resources (denial of service). Invalid chunk sizes are
  now rejected immediately with an error response, and the connection is closed.

  Own Id: OTP-20306
  Related Id(s): PR-11539

- `max_body_size` was previously enforced only after a complete chunk had been
  received, allowing a single oversized chunk to be buffered in full before the
  limit was checked ??? undermining the memory-exhaustion protection the option is
  meant to provide. The limit is now enforced incrementally as chunk data
  arrives, rejecting the request as soon as the configured size is exceeded.

  Own Id: OTP-20307
  Related Id(s): PR-11540

- The documented default of 150 for the `max_clients` option was not applied by
  the implementation, allowing an unbounded number of concurrent clients to
  connect regardless of configuration. The default is now correctly enforced.

  Own Id: OTP-20308
  Related Id(s): PR-11541

- Fixed a bug where httpd failed to start when configured with {socket_type,
  {ip_comm, SockOpts}} and a fixed (non-zero) port.

  Own Id: OTP-20342
  Related Id(s): PR-11548

- `httpc` now enforces a limit on the total size of response headers and
  response body, preventing unbounded memory allocation when connecting to a
  malicious or malfunctioning server. The new max_header_size and max_body_size
  request options can be used to override the default limit (10240 bytes for
  headers). Additionally, httpc now validates that the Content-Length header
  contains only digits before use, avoiding a crash on malformed responses.

  Own Id: OTP-20343
  Related Id(s): PR-11538

> #### Full runtime dependencies of inets-9.6.2.3
>
> erts-14.0, kernel-9.0, mnesia-4.12, public_key-1.13, runtime_tools-1.8.14,
> ssl-9.0, stdlib-5.0, stdlib-6.0

# kernel-10.6.3.4

The kernel-10.6.3.4 application can be applied independently of other
applications on a full OTP 28 installation.

## Fixed Bugs and Malfunctions

- A field in `net_kernel`'s internal state was not cleaned up in some cases for
  failed connections could cause the state to grow indefinitely over time. This
  has now been fixed.

  Own Id: OTP-20265
  Related Id(s): GH-11308, PR-11388

> #### Full runtime dependencies of kernel-10.6.3.4
>
> crypto-5.0, erts-15.2.5, sasl-3.0, stdlib-7.0

# megaco-4.8.3.2

The megaco-4.8.3.2 application can be applied independently of other
applications on a full OTP 28 installation.

## Fixed Bugs and Malfunctions

- Numeric fields in megaco text-encoded messages are now validated for
  digit-string length before integer conversion, improving robustness of the
  text decoder. Per-field digit limits based on the H.248.1 ASN.1 type
  constraints are enforced (e.g., 10 digits for UINT32, 2 digits for timer
  values), along with a 100 KB overall message size cap at the scanner entry
  point. The binary (BER/PER) codec is not affected.

  Own Id: OTP-20234
  Related Id(s): PR-11325

> #### Full runtime dependencies of megaco-4.8.3.2
>
> asn1-3.0, debugger-4.0, erts-12.0, et-1.5, kernel-8.0, runtime_tools-1.8.14,
> stdlib-2.5

# mnesia-4.25.3.2

The mnesia-4.25.3.2 application can be applied independently of other
applications on a full OTP 28 installation.

## Fixed Bugs and Malfunctions

- A transaction iterating a table (first/1, last/1, next/2, prev/2, select,
  select_reverse on non-ordered_set) leaked a safe_fixtable hold when the
  coordinator was killed by an external signal. The table remained fixed for the
  lifetime of the node, preventing space reclamation of deleted objects.

  Own Id: OTP-20347
  Related Id(s): PR-11517

- Fixed a race condition where mnesia_controller could crash if a table was
  deleted while mnesia:set_master_nodes/2 was being processed.

  Own Id: OTP-20351
  Related Id(s): PR-11554

> #### Full runtime dependencies of mnesia-4.25.3.2
>
> erts-9.0, kernel-5.3, stdlib-5.0

# snmp-5.20.2.2

The snmp-5.20.2.2 application can be applied independently of other applications
on a full OTP 28 installation.

## Fixed Bugs and Malfunctions

- The SNMP PDU decoder now bounds the byte length accepted for INTEGER,
  Counter32, Gauge32/Unsigned32, TimeTicks, and Counter64 values during decoding
  (4, 5, 5, 5, and 9 bytes respectively, matching the SMIv2 value ranges),
  instead of accepting an arbitrarily large byte string and converting it to an
  integer.

  Own Id: OTP-20346
  Related Id(s): PR-11538

> #### Full runtime dependencies of snmp-5.20.2.2
>
> asn1-5.4, crypto-4.6, erts-12.0, kernel-8.0, mnesia-4.12,
> runtime_tools-1.8.14, stdlib-5.0

# ssh-5.5.2.5

Note! The ssh-5.5.2.5 application _cannot_ be applied independently of other
applications on an arbitrary OTP 28 installation.

       On a full OTP 28 installation, also the following runtime
       dependency has to be satisfied:
       -- crypto-5.7 (first satisfied in OTP 28.1)

## Fixed Bugs and Malfunctions

- Fixed a bug where multiple subsystem requests could succeed on same ssh
  channel which is forbidden by RFC 4254 ??6.5

  Own Id: OTP-20284
  Related Id(s): PR-11437

> #### Full runtime dependencies of ssh-5.5.2.5
>
> crypto-5.7, erts-14.0, kernel-10.3, public_key-1.6.1, runtime_tools-1.15.1,
> stdlib-5.0, stdlib-6.0

# ssl-11.6.0.5

Note! The ssl-11.6.0.5 application _cannot_ be applied independently of other
applications on an arbitrary OTP 28 installation.

       On a full OTP 28 installation, also the following runtime
       dependencies have to be satisfied:
       -- crypto-5.8 (first satisfied in OTP 28.3)
       -- public_key-1.20.3.1 (first satisfied in OTP 28.5.0.1)

## Fixed Bugs and Malfunctions

- Debugging keylog_hs callback used for logging handshake secrets on failed
  connections swapped the argument order in logging function confusing server
  and client side. The bug was introduced in OTP 28.5

  Own Id: OTP-20350
  Related Id(s): ERIERL-1354, PR-11553

## Improvements and New Features

- Hardening improvements of the ssl application.

  TLS distribution now defaults to TLS-1.3 instead of TLS-1.2 (TLS-1.2 is kept
  as fallback for rolling upgrades).

  TLS-1.2 server with {verify, verify_peer} now defaults reuse_sessions to false
  to mitigate the Triple Handshake attack (RFC 7627). Set {reuse_sessions, true}
  explicitly to restore previous behavior.

  Various missing or faulty sanity checks added and TLS alerts adjusted to
  comply with RFC MUST requirements, including: signature algorithm validation
  for intermediate certificates, TLS-1.3 session_id echo, pre_shared_key
  extension ordering, and renegotiation_info enforcement.

  Hardened and improved CRL support. Introduces new option allowed_hosts for the
  optional CRL HTTP fetching feature to restrict which hosts may be contacted.
  Internal/loopback IPs are now blocked by default (SSRF protection).

  TLS-1.3 client ticket handling is more robust (locked tickets are released on
  client crash). Server TLS-1.3 ticket handling and anti-replay Bloom filter
  performance are optimized.

  DTLS duplicate ChangeCipherSpec handling simplified, fixing potential state
  machine confusion (GH-11075).

  Process state formatting no longer leaks secrets in crash logs.

  Own Id: OTP-20289
  Related Id(s): PR-11478

> #### Full runtime dependencies of ssl-11.6.0.5
>
> crypto-5.8, erts-16.0, inets-5.10.7, kernel-10.3, public_key-1.20.3.1,
> runtime_tools-1.15.1, stdlib-7.0

# stdlib-7.3.0.2

Note! The stdlib-7.3.0.2 application _cannot_ be applied independently of other
applications on an arbitrary OTP 28 installation.

       On a full OTP 28 installation, also the following runtime
       dependency has to be satisfied:
       -- erts-16.0.3 (first satisfied in OTP 28.0.3)

## Fixed Bugs and Malfunctions

- Fixed a bug in unicode_util:gc/1 where the grapheme cluster segmentation of
  `$\r` (not followed by `$\n`) would decompose binary continuations into mixed
  chardata. This caused string:trim/3 (and string:chomp/1) to return
  incorrect results or crash when trimming strings containing binaries followed
  by another list element.

  Own Id: OTP-20296
  Related Id(s): GH-11380, PR-11464

- When compiling a module with a triple-quoted string with escape sequences and
  a chunk boundary happened to fall just after an escape character, that
  character was not passed to the reentrancy continuation, so the scanner
  interpreted the following characters as not an escape sequence.

  This bug has now been fixed.

  Own Id: OTP-20320
  Related Id(s): GH-11423, PR-11505

- uri_string:parse/1 now rejects URIs with an unreasonably long port component
  (more than 5 digits) instead of attempting to convert an arbitrarily large
  digit string to an integer.

  Own Id: OTP-20344
  Related Id(s): PR-11538

> #### Full runtime dependencies of stdlib-7.3.0.2
>
> compiler-5.0, crypto-4.5, erts-16.0.3, kernel-10.0, sasl-3.0,
> syntax_tools-3.2.1

# tools-4.1.4.1

The tools-4.1.4.1 application can be applied independently of other applications
on a full OTP 28 installation.

## Fixed Bugs and Malfunctions

- tools: fixes tprof not stopping tracing

  A call to `tprof:enable_trace(new|existing)` starts tracing processes. To stop
  it, one calls `tprof:disable_trace(new|existing)`. However, the guard to stop
  tracing was matching on `new_processes | existing_processes`. The return
  happens to say `0` processes are traced now, but the tracing did not stop.
  This issue has been fixed.

  Own Id: OTP-20302
  Related Id(s): PR-11481

> #### Full runtime dependencies of tools-4.1.4.1
>
> compiler-8.5, erts-15.0, erts-15.0, kernel-10.0, runtime_tools-2.1, stdlib-6.0

# Thanks to

Andrew Bennett, Laurynas ??etyrkinas, ruslandoga, Thomas Cioppettini


From otp@REDACTED  Tue Sep  1 15:31:32 2026
From: otp@REDACTED (Erlang/OTP)
Date: Tue, 01 Sep 2026 15:31:32 +0200 (CEST)
Subject: Patch Package OTP 27.3.4.17 Released
Message-ID: <20260901133132.CF1A92C540@hel.cslab.ericsson.net>

Patch Package:           OTP 27.3.4.17
Git Tag:                 OTP-27.3.4.17
Date:                    2026-09-01
Trouble Report Id:       OTP-20135, OTP-20234, OTP-20264, OTP-20265,
                         OTP-20268, OTP-20269, OTP-20270, OTP-20271,
                         OTP-20273, OTP-20278, OTP-20279, OTP-20281,
                         OTP-20282, OTP-20284, OTP-20289, OTP-20296,
                         OTP-20302, OTP-20306, OTP-20307, OTP-20308,
                         OTP-20312, OTP-20319, OTP-20320, OTP-20324,
                         OTP-20330, OTP-20333, OTP-20334, OTP-20342,
                         OTP-20343, OTP-20344, OTP-20345, OTP-20346,
                         OTP-20347, OTP-20349, OTP-20351
Seq num:                 CVE-2026-75538, ERIERL-1352, GH-11052,
                         GH-11278, GH-11308, GH-11380, GH-11404,
                         GH-11419, GH-11423, GH-11494, GH-11511,
                         OTP-20037, OTP-20199, PR-11247, PR-11285,
                         PR-11325, PR-11388, PR-11425, PR-11428,
                         PR-11429, PR-11437, PR-11463, PR-11464,
                         PR-11478, PR-11481, PR-11492, PR-11503,
                         PR-11505, PR-11509, PR-11513, PR-11517,
                         PR-11521, PR-11533, PR-11538, PR-11539,
                         PR-11540, PR-11541, PR-11542, PR-11543,
                         PR-11544, PR-11545, PR-11546, PR-11547,
                         PR-11548, PR-11554
System:                  OTP
Release:                 27
Application:             compiler-8.6.1.6, crypto-5.5.3.5,
                         eldap-1.2.14.2, erl_interface-5.5.2.2,
                         erts-15.2.7.13, inets-9.3.2.7,
                         kernel-10.2.7.5, megaco-4.7.2.3,
                         mnesia-4.23.5.4, snmp-5.18.2.1,
                         ssh-5.2.11.12, ssl-11.2.12.12,
                         stdlib-6.2.2.5, tools-4.1.1.1
Predecessor:             OTP 27.3.4.16

Check out the git tag OTP-27.3.4.17, and build a full OTP system including
documentation. Apply one or more applications from this build as patches to your
installation using the 'otp_patch_apply' tool. For information on install
requirements, see descriptions for each application version below.

# compiler-8.6.1.6

The compiler-8.6.1.6 application can be applied independently of other
applications on a full OTP 27 installation.

## Fixed Bugs and Malfunctions

- compiler: Fix bug in beam_types:subtract/2 for bitstrings

  Own Id: OTP-20312
  Related Id(s): GH-11494, PR-11503

> #### Full runtime dependencies of compiler-8.6.1.6
>
> crypto-5.1, erts-13.0, kernel-8.4, stdlib-6.0

# crypto-5.5.3.5

The crypto-5.5.3.5 application can be applied independently of other
applications on a full OTP 27 installation.

## Fixed Bugs and Malfunctions

- Fixed type mismatch between `ErlNifUInt64` and `uint64_t` in crypto NIF that
  caused incompatible-pointer warnings on macOS arm64 when passing DH parameters
  to OpenSSL.

  Own Id: OTP-20333
  Related Id(s): GH-11511, PR-11513

> #### Full runtime dependencies of crypto-5.5.3.5
>
> erts-9.0, kernel-5.3, stdlib-3.9

# eldap-1.2.14.2

The eldap-1.2.14.2 application can be applied independently of other
applications on a full OTP 27 installation.

## Fixed Bugs and Malfunctions

- eldap referral URL parsing now rejects a port component longer than 5 digits
  instead of attempting to convert an arbitrarily large digit string to an
  integer.

  Own Id: OTP-20345
  Related Id(s): PR-11538

> #### Full runtime dependencies of eldap-1.2.14.2
>
> asn1-3.0, erts-6.0, kernel-3.0, ssl-5.3.4, stdlib-3.4

# erl_interface-5.5.2.2

The erl_interface-5.5.2.2 application can be applied independently of other
applications on a full OTP 27 installation.

## Fixed Bugs and Malfunctions

- erl_interface: Fix buffer leak and state corruption on `ei_x_buff` realloc
  failure

  Own Id: OTP-20324
  Related Id(s): PR-11492

# erts-15.2.7.13

The erts-15.2.7.13 application can be applied independently of other
applications on a full OTP 27 installation.

## Fixed Bugs and Malfunctions

- No-suspend port command signals (i.e. port command signals sent using the
  erlang:port_command/3 BIF or the erlang:send/3 BIF with the `nosuspend`
  option) were not aborted properly in all scenarios which could leave the port
  queue in a busy state indefinitely. Also asynchronously sent no-suspend
  command signals (i.e, port command signals sent using the erlang:send/3 BIF
  with the `nosuspend` option) could sometimes be delivered even though the port
  was busy.

  Own Id: OTP-20135
  Related Id(s): GH-11052, PR-11463

- erts: Fix missing exit_status caused by SIGCHLD race

  Own Id: OTP-20273
  Related Id(s): GH-11278, PR-11285

- erts: Fix bug in `is_in_range` instruction for x86 JIT

  Own Id: OTP-20278
  Related Id(s): GH-11419, PR-11429

- Fixed bug in `binary_to_term` that could cause emulator crash for specific
  terms in specific process states (reductions left).

  Own Id: OTP-20281
  Related Id(s): GH-11404, PR-11425

- erts: Fix crash with `term_to_iovec/2` for large binary

  Own Id: OTP-20282
  Related Id(s): PR-11428

- A monitor of `time_offset` co-created with a process alias
  (`monitor(time_offset, clock_service, {alias, UnaliasOpt})`) either crashed
  the runtime system or did not work. This bug was introduced in OTP 25.0.

  Own Id: OTP-20319
  Related Id(s): PR-11509

- A process alias was erroneously created when a remote `spawn_request()`
  operation with a `{monitor, {alias, explicit_unalias}}` option failed with
  `noconnection` reason.

  Own Id: OTP-20330
  Related Id(s): PR-11521

- A `gen_tcp` socket using the inet driver and `{packet,4}` had a bug if
  receiving a packet with size just below INT_MAX.

  That packet size wrapped in size calculations and made the received data
  overwrite its allocation and trash allocator metadata and subsequent block(s),
  causing the VM to crash.

  This made it possible for anyone to remotely crash an Erlang node that used
  `{packet,4}` on a reachable socket.

  This bug has been corrected.

  Own Id: OTP-20334
  Related Id(s): PR-11533, CVE-2026-75538

> #### Full runtime dependencies of erts-15.2.7.13
>
> kernel-9.0, sasl-3.3, stdlib-4.1

# inets-9.3.2.7

The inets-9.3.2.7 application can be applied independently of other applications
on a full OTP 27 installation.

## Fixed Bugs and Malfunctions

- The `dets` and `mnesia` `mod_auth` backends used a key that did not include
  the directory path, so all `require_user`/`require_group` records collapsed
  into one per-listener namespace. A user authorized for one protected directory
  could authenticate against any other protected directory served by the same
  listener. `{path, Directory}` is now included in the auth backend key, scoping
  records per directory as documented.

  Own Id: OTP-20264
  Related Id(s): PR-11546

- Requests specifying both `Transfer-Encoding` and `Content-Length` headers are
  now rejected with `400 Bad Request`, per RFC 9112 Section 6.3. Previously such
  requests could be used for CL.TE request-smuggling/desync attacks against
  reverse proxies in front of `httpd`.

  Own Id: OTP-20268
  Related Id(s): PR-11547

- `httpd` accepted the obsolete header line-folding syntax (RFC 9112 Section
  5.2, a continuation line beginning with space/tab), silently treating the
  folded continuation as a separate header. This allowed CL.TE-style request
  smuggling when `httpd` was placed behind a folding-aware proxy. Such requests
  are now rejected with `400 Bad Request`.

  Own Id: OTP-20269
  Related Id(s): PR-11544

- A header such as `Content-Length : 6` (whitespace before the colon) was
  previously silently dropped, causing the content length to default to 0 and
  the body bytes to be misinterpreted as a pipelined request (CL.0 smuggling).
  Per RFC 7230 Section 3.2.4, such headers are now rejected with
  `400 Bad Request`.

  Own Id: OTP-20270
  Related Id(s): PR-11545

- A new httpd option `request_timeout` (default 60 seconds, renamed from the
  interim `max_body_read_timeout`) bounds the idle time between reads of a
  request body/message. The server now also sends `408 Request Timeout` when the
  `min_bytes_per_second` floor is hit, and `keep_alive_timeout` measurement was
  corrected so the timer is cancelled as soon as new data arrives rather than
  only after full header parsing; `keep_alive_timeout` and `request_timeout` now
  also accept `infinity` to disable the timeout.

  Own Id: OTP-20271
  Related Id(s): PR-11543

- `mod_auth`, `mod_security`, and `mod_get` compared resolved filesystem paths
  against configured protected-directory patterns without normalizing repeated
  slashes or filesystem case. On case-insensitive filesystems (macOS, Windows)
  or with repeated slashes, a request could resolve to a protected resource
  while evading the directory match. Paths are now canonicalized
  (slash-collapsed, and case-normalized when the filesystem is case-insensitive)
  before the authorization decision.

  Own Id: OTP-20279
  Related Id(s): PR-11542

- A request with an invalid chunked transfer-encoding chunk size previously
  caused the httpd connection handler to hang indefinitely without requiring
  further input from the client. This leaked a process per request and could be
  used to exhaust server resources (denial of service). Invalid chunk sizes are
  now rejected immediately with an error response, and the connection is closed.

  Own Id: OTP-20306
  Related Id(s): PR-11539

- `max_body_size` was previously enforced only after a complete chunk had been
  received, allowing a single oversized chunk to be buffered in full before the
  limit was checked ??? undermining the memory-exhaustion protection the option is
  meant to provide. The limit is now enforced incrementally as chunk data
  arrives, rejecting the request as soon as the configured size is exceeded.

  Own Id: OTP-20307
  Related Id(s): PR-11540

- The documented default of 150 for the `max_clients` option was not applied by
  the implementation, allowing an unbounded number of concurrent clients to
  connect regardless of configuration. The default is now correctly enforced.

  Own Id: OTP-20308
  Related Id(s): PR-11541

- Fixed a bug where httpd failed to start when configured with {socket_type,
  {ip_comm, SockOpts}} and a fixed (non-zero) port.

  Own Id: OTP-20342
  Related Id(s): PR-11548

- `httpc` now enforces a limit on the total size of response headers and
  response body, preventing unbounded memory allocation when connecting to a
  malicious or malfunctioning server. The new max_header_size and max_body_size
  request options can be used to override the default limit (10240 bytes for
  headers). Additionally, httpc now validates that the Content-Length header
  contains only digits before use, avoiding a crash on malformed responses.

  Own Id: OTP-20343
  Related Id(s): PR-11538

> #### Full runtime dependencies of inets-9.3.2.7
>
> erts-14.0, kernel-9.0, mnesia-4.12, public_key-1.13, runtime_tools-1.8.14,
> ssl-9.0, stdlib-5.0, stdlib-6.0

# kernel-10.2.7.5

Note! The kernel-10.2.7.5 application _cannot_ be applied independently of other
applications on an arbitrary OTP 27 installation.

       On a full OTP 27 installation, also the following runtime
       dependency has to be satisfied:
       -- erts-15.2.5 (first satisfied in OTP 27.3.2)

## Fixed Bugs and Malfunctions

- A field in `net_kernel`'s internal state was not cleaned up in some cases for
  failed connections could cause the state to grow indefinitely over time. This
  has now been fixed.

  Own Id: OTP-20265
  Related Id(s): GH-11308, PR-11388

- Handling of the truncation bit in `inet_res` has been fixed so it properly
  falls back to querying over TCP after a truncated UDP reply.

  This fixes a bug introduced in OTP-27.3.4.10, kernel-10.2.7.4 making a
  truncated UDP answer fail to parse and never execute the fallback, instead the
  name resolve operation fails.

  Own Id: OTP-20349
  Related Id(s): ERIERL-1352, PR-11247, OTP-20037, OTP-20199

> #### Full runtime dependencies of kernel-10.2.7.5
>
> crypto-5.0, erts-15.2.5, sasl-3.0, stdlib-6.0

# megaco-4.7.2.3

The megaco-4.7.2.3 application can be applied independently of other
applications on a full OTP 27 installation.

## Fixed Bugs and Malfunctions

- Numeric fields in megaco text-encoded messages are now validated for
  digit-string length before integer conversion, improving robustness of the
  text decoder. Per-field digit limits based on the H.248.1 ASN.1 type
  constraints are enforced (e.g., 10 digits for UINT32, 2 digits for timer
  values), along with a 100 KB overall message size cap at the scanner entry
  point. The binary (BER/PER) codec is not affected.

  Own Id: OTP-20234
  Related Id(s): PR-11325

> #### Full runtime dependencies of megaco-4.7.2.3
>
> asn1-3.0, debugger-4.0, erts-12.0, et-1.5, kernel-8.0, runtime_tools-1.8.14,
> stdlib-2.5

# mnesia-4.23.5.4

The mnesia-4.23.5.4 application can be applied independently of other
applications on a full OTP 27 installation.

## Fixed Bugs and Malfunctions

- A transaction iterating a table (first/1, last/1, next/2, prev/2, select,
  select_reverse on non-ordered_set) leaked a safe_fixtable hold when the
  coordinator was killed by an external signal. The table remained fixed for the
  lifetime of the node, preventing space reclamation of deleted objects.

  Own Id: OTP-20347
  Related Id(s): PR-11517

- Fixed a race condition where mnesia_controller could crash if a table was
  deleted while mnesia:set_master_nodes/2 was being processed.

  Own Id: OTP-20351
  Related Id(s): PR-11554

> #### Full runtime dependencies of mnesia-4.23.5.4
>
> erts-9.0, kernel-5.3, stdlib-5.0

# snmp-5.18.2.1

The snmp-5.18.2.1 application can be applied independently of other applications
on a full OTP 27 installation.

## Fixed Bugs and Malfunctions

- The SNMP PDU decoder now bounds the byte length accepted for INTEGER,
  Counter32, Gauge32/Unsigned32, TimeTicks, and Counter64 values during decoding
  (4, 5, 5, 5, and 9 bytes respectively, matching the SMIv2 value ranges),
  instead of accepting an arbitrarily large byte string and converting it to an
  integer.

  Own Id: OTP-20346
  Related Id(s): PR-11538

> #### Full runtime dependencies of snmp-5.18.2.1
>
> crypto-4.6, erts-12.0, kernel-8.0, mnesia-4.12, runtime_tools-1.8.14,
> stdlib-5.0

# ssh-5.2.11.12

The ssh-5.2.11.12 application can be applied independently of other applications
on a full OTP 27 installation.

## Fixed Bugs and Malfunctions

- Fixed a bug where multiple subsystem requests could succeed on same ssh
  channel which is forbidden by RFC 4254 ??6.5

  Own Id: OTP-20284
  Related Id(s): PR-11437

> #### Full runtime dependencies of ssh-5.2.11.12
>
> crypto-5.0, erts-14.0, kernel-9.0, public_key-1.6.1, runtime_tools-1.15.1,
> stdlib-5.0, stdlib-6.0

# ssl-11.2.12.12

Note! The ssl-11.2.12.12 application _cannot_ be applied independently of other
applications on an arbitrary OTP 27 installation.

       On a full OTP 27 installation, also the following runtime
       dependency has to be satisfied:
       -- public_key-1.17.1.3 (first satisfied in OTP 27.3.4.12)

## Improvements and New Features

- Hardening improvements of the ssl application.

  TLS distribution now defaults to TLS-1.3 instead of TLS-1.2 (TLS-1.2 is kept
  as fallback for rolling upgrades).

  TLS-1.2 server with {verify, verify_peer} now defaults reuse_sessions to false
  to mitigate the Triple Handshake attack (RFC 7627). Set {reuse_sessions, true}
  explicitly to restore previous behavior.

  Various missing or faulty sanity checks added and TLS alerts adjusted to
  comply with RFC MUST requirements, including: signature algorithm validation
  for intermediate certificates, TLS-1.3 session_id echo, pre_shared_key
  extension ordering, and renegotiation_info enforcement.

  Hardened and improved CRL support. Introduces new option allowed_hosts for the
  optional CRL HTTP fetching feature to restrict which hosts may be contacted.
  Internal/loopback IPs are now blocked by default (SSRF protection).

  TLS-1.3 client ticket handling is more robust (locked tickets are released on
  client crash). Server TLS-1.3 ticket handling and anti-replay Bloom filter
  performance are optimized.

  DTLS duplicate ChangeCipherSpec handling simplified, fixing potential state
  machine confusion (GH-11075).

  Process state formatting no longer leaks secrets in crash logs.

  Own Id: OTP-20289
  Related Id(s): PR-11478

> #### Full runtime dependencies of ssl-11.2.12.12
>
> crypto-5.1, erts-15.0, inets-5.10.7, kernel-9.0, public_key-1.17.1.3,
> runtime_tools-1.15.1, stdlib-6.0

# stdlib-6.2.2.5

The stdlib-6.2.2.5 application can be applied independently of other
applications on a full OTP 27 installation.

## Fixed Bugs and Malfunctions

- Fixed a bug in unicode_util:gc/1 where the grapheme cluster segmentation of
  `$\r` (not followed by `$\n`) would decompose binary continuations into mixed
  chardata. This caused string:trim/3 (and string:chomp/1) to return
  incorrect results or crash when trimming strings containing binaries followed
  by another list element.

  Own Id: OTP-20296
  Related Id(s): GH-11380, PR-11464

- When compiling a module with a triple-quoted string with escape sequences and
  a chunk boundary happened to fall just after an escape character, that
  character was not passed to the reentrancy continuation, so the scanner
  interpreted the following characters as not an escape sequence.

  This bug has now been fixed.

  Own Id: OTP-20320
  Related Id(s): GH-11423, PR-11505

- uri_string:parse/1 now rejects URIs with an unreasonably long port component
  (more than 5 digits) instead of attempting to convert an arbitrarily large
  digit string to an integer.

  Own Id: OTP-20344
  Related Id(s): PR-11538

> #### Full runtime dependencies of stdlib-6.2.2.5
>
> compiler-5.0, crypto-4.5, erts-15.0, kernel-10.0, sasl-3.0

# tools-4.1.1.1

The tools-4.1.1.1 application can be applied independently of other applications
on a full OTP 27 installation.

## Fixed Bugs and Malfunctions

- tools: fixes tprof not stopping tracing

  A call to `tprof:enable_trace(new|existing)` starts tracing processes. To stop
  it, one calls `tprof:disable_trace(new|existing)`. However, the guard to stop
  tracing was matching on `new_processes | existing_processes`. The return
  happens to say `0` processes are traced now, but the tracing did not stop.
  This issue has been fixed.

  Own Id: OTP-20302
  Related Id(s): PR-11481

> #### Full runtime dependencies of tools-4.1.1.1
>
> compiler-8.5, erts-15.0, erts-15.0, kernel-10.0, runtime_tools-2.1, stdlib-6.0

# Thanks to

Laurynas ??etyrkinas, ruslandoga, Thomas Cioppettini