# Erlang/OTP changelog > The Erlang programming language and OTP runtime for massively concurrent systems. - Vendor: Ericsson - Category: Languages & Runtimes - Official site: https://www.erlang.org - Tracked by: What's New (https://whatsnew.fyi/product/erlang-otp) - Harvested from: GitHub (erlang/otp) - Entries below: 10 (newest first) What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. ## Releases ### OTP-28.5.0.5 — OTP 28.5.0.5 - Date: 2026-08-04 - Version: OTP-28.5.0.5 - Original notes: https://github.com/erlang/otp/releases/tag/OTP-28.5.0.5 - Permalink: https://whatsnew.fyi/product/erlang-otp/releases/otp-28.5.0.5 - **fixed** — Fixed a regression in the previous patch release that prevented epmd from binding to localhost - **security** — The SSH client and server now reject incoming packets not aligned to the cipher block size as required by RFC 4253 §6, with timing-safe packet discard for CBC ciphers to mitigate CVE-2008-5161 ``` Patch Package: OTP 28.5.0.5 Git Tag: OTP-28.5.0.5 Date: 2026-08-04 Trouble Report Id: OTP-20137, OTP-20275 Seq num: GH-11402, PR-11110, PR-11409 System: OTP Release: 28 Application: erts-16.4.0.5, ssh-5.5.2.4 Predecessor: OTP 28.5.0.4 ``` Check out the git tag OTP-28.5.0.5, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below. #### erts-16.4.0.5 The erts-16.4.0.5 application can be applied independently of other applications on a full OTP 28 installation. ##### Fixed Bugs and Malfunctions - Fixed a regression in the previous patch release that prevented epmd from binding to localhost. Own Id: OTP-20275\ Related Id(s): [GH-11402], [PR-11409] > #### Full runtime dependencies of erts-16.4.0.5 > > kernel-9.0, sasl-3.3, stdlib-4.1 #### ssh-5.5.2.4 Note! The ssh-5.5.2.4 application _cannot_ be applied independently of other applications on an arbitrary OTP 28 installation. ``` On a full OTP 28 installation, also the following runtime dependency has to be satisfied: -- crypto-5.7 (first satisfied in OTP 28.1) ``` ##### Fixed Bugs and Malfunctions - The SSH client and server now reject incoming packets not aligned to the cipher block size as required by RFC 4253 §6. For CBC ciphers, a timing-safe "packet discard" mechanism (CVE-2008-5161 mitigation) ensures structural errors are indistinguishable from MAC failures before disconnecting. AEAD and encrypt-then-MAC modes disconnect immediately. Own Id: OTP-20137\ Related Id(s): [PR-11110] > #### Full runtime dependencies of ssh-5.5.2.4 > > crypto-5.7, erts-14.0, kernel-10.3, public_key-1.6.1, runtime_tools-1.15.1, stdlib-5.0, stdlib-6.0 [gh-11402]: https://github.com/erlang/otp/issues/11402 [pr-11110]: https://github.com/erlang/otp/pull/11110 [pr-11409]: https://github.com/erlang/otp/pull/11409 ### OTP-29.0.5 — OTP 29.0.5 - Date: 2026-08-04 - Version: OTP-29.0.5 - Original notes: https://github.com/erlang/otp/releases/tag/OTP-29.0.5 - Permalink: https://whatsnew.fyi/product/erlang-otp/releases/otp-29.0.5 - **fixed** — Fixed a regression in the previous patch release that prevented epmd from binding to localhost - **security** — The SSH client and server now reject incoming packets not aligned to the cipher block size as required by RFC 4253 §6, with timing-safe packet discard for CBC ciphers to mitigate CVE-2008-5161 ``` Patch Package: OTP 29.0.5 Git Tag: OTP-29.0.5 Date: 2026-08-04 Trouble Report Id: OTP-20137, OTP-20275 Seq num: GH-11402, PR-11110, PR-11409 System: OTP Release: 29 Application: erts-17.0.5, ssh-6.0.4 Predecessor: OTP 29.0.4 ``` Check out the git tag OTP-29.0.5, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below. #### erts-17.0.5 The erts-17.0.5 application can be applied independently of other applications on a full OTP 29 installation. ##### Fixed Bugs and Malfunctions - Fixed a regression in the previous patch release that prevented epmd from binding to localhost. Own Id: OTP-20275\ Related Id(s): [GH-11402], [PR-11409] > #### Full runtime dependencies of erts-17.0.5 > > kernel-9.0, sasl-3.3, stdlib-4.1 #### ssh-6.0.4 The ssh-6.0.4 application can be applied independently of other applications on a full OTP 29 installation. ##### Fixed Bugs and Malfunctions - The SSH client and server now reject incoming packets not aligned to the cipher block size as required by RFC 4253 §6. For CBC ciphers, a timing-safe "packet discard" mechanism (CVE-2008-5161 mitigation) ensures structural errors are indistinguishable from MAC failures before disconnecting. AEAD and encrypt-then-MAC modes disconnect immediately. Own Id: OTP-20137\ Related Id(s): [PR-11110] > #### Full runtime dependencies of ssh-6.0.4 > > crypto-5.7, erts-14.0, kernel-10.3, public_key-1.6.1, runtime_tools-1.15.1, stdlib-8.0 [gh-11402]: https://github.com/erlang/otp/issues/11402 [pr-11110]: https://github.com/erlang/otp/pull/11110 [pr-11409]: https://github.com/erlang/otp/pull/11409 ### OTP-27.3.4.16 — OTP 27.3.4.16 - Date: 2026-08-04 - Version: OTP-27.3.4.16 - Original notes: https://github.com/erlang/otp/releases/tag/OTP-27.3.4.16 - Permalink: https://whatsnew.fyi/product/erlang-otp/releases/otp-27.3.4.16 ### OTP-28.5.0.4 — OTP 28.5.0.4 - Date: 2026-07-27 - Version: OTP-28.5.0.4 - Original notes: https://github.com/erlang/otp/releases/tag/OTP-28.5.0.4 - Permalink: https://whatsnew.fyi/product/erlang-otp/releases/otp-28.5.0.4 ### OTP-27.3.4.15 — OTP 27.3.4.15 - Date: 2026-07-27 - Version: OTP-27.3.4.15 - Original notes: https://github.com/erlang/otp/releases/tag/OTP-27.3.4.15 - Permalink: https://whatsnew.fyi/product/erlang-otp/releases/otp-27.3.4.15 ### OTP-29.0.4 — OTP 29.0.4 - Date: 2026-07-27 - Version: OTP-29.0.4 - Original notes: https://github.com/erlang/otp/releases/tag/OTP-29.0.4 - Permalink: https://whatsnew.fyi/product/erlang-otp/releases/otp-29.0.4 - **security** — Mitigated a denial of service attack in epmd - **fixed** — Fix an internal consistency check failure in compiler with setelement - **fixed** — Fixed crash in crypto:macN/5 when supplied MacLength was greater than length of what the underlying hash returned - **fixed** — Fixed segfault in crypto:aead_cipher_init_nif when argument validation fails - **fixed** — Fix cipher key buffer overread for chacha20_poly1305 - **fixed** — Fix infinite loop in diameter_dist:route_session/2 when avp other than Session-Id has zero length - **fixed** — Fix crash in diameter_dist:route_session/2 when Session-Id avp has zero length - **security** — Fixed heap corruption when an invalidly encoded tuple with an arity of 2^31 or larger is decoded from Erlang's External Term Format - **fixed** — When send_timeout is set and send_timeout_close is set to true, a tcp_closed message is now delivered when the timeout occurs - **security** — Fixed a crafted External Term Format payload that could crash the runtime system - **fixed** — Fixed a rounding error in 16-bit float conversion - **security** — Fixed a buffer overflow in the megaco flex scanner C driver where a property parm name exceeding 452 bytes could crash the VM - **security** — A certificate chain with crafted policyMappings extensions that could cause exponential memory consumption during path validation is now rejected with bad_cert policy_tree_exceeded ``` Patch Package: OTP 29.0.4 Git Tag: OTP-29.0.4 Date: 2026-07-27 Trouble Report Id: OTP-20136, OTP-20143, OTP-20214, OTP-20229, OTP-20237, OTP-20239, OTP-20240, OTP-20241, OTP-20242, OTP-20243, OTP-20244, OTP-20245, OTP-20248, OTP-20250, OTP-20251, OTP-20257, OTP-20258, OTP-20259, OTP-20260, OTP-20261 Seq num: CVE-2026-42792, CVE-2026-47078, CVE-2026-54890, CVE-2026-55737, CVE-2026-55953, CVE-2026-58227, ERIERL-1341, GH-11319, GH-11332, GH-11368, GH-SA-622p-qfh6-c352, GH-SA-7xgh-gmgf-q2g7, PR-11239, PR-11297, PR-11303, PR-11323, PR-11330, PR-11331, PR-11333, PR-11334, PR-11336, PR-11337, PR-11341, PR-11343, PR-11369, PR-11372, PR-11374, PR-11386, PR-27944 System: OTP Release: 29 Application: compiler-10.0.3, crypto-5.9.2, diameter-2.7.2, erts-17.0.4, megaco-4.9.1, public_key-1.21.4, ssh-6.0.3, ssl-11.7.4, stdlib-8.0.3 Predecessor: OTP 29.0.3 ``` Check out the git tag OTP-29.0.4, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below. #### POTENTIAL INCOMPATIBILITIES - Mitigated a denial of service attack in epmd. Thanks to Ryan Moore for finding and responsibly disclosing this vulnerability to the Erlang/OTP project. Own Id: OTP-20136\ Application(s): erts\ Related Id(s): [PR-11386], [CVE-2026-42792] #### compiler-10.0.3 The compiler-10.0.3 application can be applied independently of other applications on a full OTP 29 installation. ##### Fixed Bugs and Malfunctions - compiler: Fix an internal consistency check failure with `setelement` Own Id: OTP-20261\ Related Id(s): [GH-11368], [PR-11374] > #### Full runtime dependencies of compiler-10.0.3 > > crypto-5.1, erts-13.0, kernel-8.4, stdlib-8.0 #### crypto-5.9.2 The crypto-5.9.2 application can be applied independently of other applications on a full OTP 29 installation. ##### Fixed Bugs and Malfunctions - Fixed crash in `crypto:macN/5` when supplied `MacLength` was greater than length of what the underlying hash returned. Own Id: OTP-20239\ Related Id(s): [PR-11239] - Fixed segfault in `crypto:aead_cipher_init_nif` when argument validation fails. Own Id: OTP-20241\ Related Id(s): [PR-11330] - Fix cipher key buffer overread for `chacha20_poly1305`. Own Id: OTP-20244\ Related Id(s): [PR-11337] > #### Full runtime dependencies of crypto-5.9.2 > > erts-9.0, kernel-6.0, stdlib-3.9 #### diameter-2.7.2 The diameter-2.7.2 application can be applied independently of other applications on a full OTP 29 installation. ##### Fixed Bugs and Malfunctions - Fix infinite loop in `diameter_dist:route_session/2` when avp other than `Session-Id` has zero length. Own Id: OTP-20242\ Related Id(s): [PR-11331] - Fix crash in `diameter_dist:route_session/2` when `Session-Id` (code: 263) avp has zero length. Own Id: OTP-20243\ Related Id(s): [PR-11333] > #### Full runtime dependencies of diameter-2.7.2 > > erts-10.0, kernel-3.2, ssl-9.0, stdlib-5.0 #### erts-17.0.4 The erts-17.0.4 application can be applied independently of other applications on a full OTP 29 installation. ##### Fixed Bugs and Malfunctions - Mitigated a denial of service attack in epmd. Thanks to Ryan Moore for finding and responsibly disclosing this vulnerability to the Erlang/OTP project. Own Id: OTP-20136\ Related Id(s): [PR-11386], [CVE-2026-427 _[Truncated at 4000 characters — full notes: https://github.com/erlang/otp/releases/tag/OTP-29.0.4]_ ### OTP-27.3.4.14 — OTP 27.3.4.14 - Date: 2026-07-02 - Version: OTP-27.3.4.14 - Original notes: https://github.com/erlang/otp/releases/tag/OTP-27.3.4.14 - Permalink: https://whatsnew.fyi/product/erlang-otp/releases/otp-27.3.4.14 ### OTP-28.5.0.3 — OTP 28.5.0.3 - Date: 2026-07-02 - Version: OTP-28.5.0.3 - Original notes: https://github.com/erlang/otp/releases/tag/OTP-28.5.0.3 - Permalink: https://whatsnew.fyi/product/erlang-otp/releases/otp-28.5.0.3 - **fixed** — Fixed a crash in ct_netconfc that occurred when the remote server closed the SSH connection during NETCONF subsystem negotiation - **fixed** — crypto:compute_key/4 for eddh and crypto:generate_key/2,3 for eddh/eddsa now raise an error:{notsup, Info, Description} exception instead of returning the atom notsup when the underlying cryptolib lacks support - **fixed** — Fixed an undefined behavior in the internal erts_qsort() function, which could have been the cause of a beam crash seen when updating large maps - **fixed** — Calculating bxor of the largest supported positive integer (erlang:system_info(max_integer)) and -1 would return [] instead of raising a system_limit exception - **fixed** — Fix possible race between ets:delete/1 and terminating process with a fixation on the same table - **fixed** — A few code generation issues for the JIT on AArch64 (ARM64) have been fixed - **changed** — Arithmetic operations on large integers will now increase the reduction count for the process, causing context switches to occur more frequently when doing arithmetic on large integers - **fixed** — inet:info/1 could crash when calling for a closing (port) socket - **fixed** — Handling of the truncation bit in inet_res has been fixed so it properly falls back to querying over TCP after a truncated UDP reply - **fixed** — Hardened OCSP response verification by using constant-time hash comparisons and rejecting responses exceeding 100 KB before ASN.1 decoding ``` Patch Package: OTP 28.5.0.3 Git Tag: OTP-28.5.0.3 Date: 2026-07-02 Trouble Report Id: OTP-20173, OTP-20183, OTP-20185, OTP-20186, OTP-20190, OTP-20191, OTP-20194, OTP-20196, OTP-20197, OTP-20199, OTP-20200, OTP-20206, OTP-20207, OTP-20208, OTP-20211, OTP-20215, OTP-20216, OTP-20217, OTP-20220, OTP-20226, OTP-20230, OTP-20231, OTP-20232 Seq num: CVE-2026-53422, CVE-2026-54886, CVE-2026-54887, CVE-2026-54891, CVE-2026-55950, CVE-2026-55952, ERIERL-1333, GH-SA-7wp4-pc27-2vj9, GH-SA-h9pw-h5w4-h976, PR-11209, PR-11215, PR-11230, PR-11239, PR-11247, PR-11250, PR-11259, PR-11268, PR-11269, PR-11270, PR-11271, PR-11274, PR-11282, PR-11283, PR-11294, PR-11295, PR-11299, PR-11302, PR-11306, PR-11307, PR-11309, PR-11311 System: OTP Release: 28 Application: common_test-1.30.0.1, crypto-5.8.3.1, erts-16.4.0.3, kernel-10.6.3.3, public_key-1.20.3.3, ssh-5.5.2.2, ssl-11.6.0.3 Predecessor: OTP 28.5.0.2 ``` Check out the git tag OTP-28.5.0.3, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below. #### common_test-1.30.0.1 The common_test-1.30.0.1 application can be applied independently of other applications on a full OTP 28 installation. ##### Fixed Bugs and Malfunctions - Fixed a crash in ct_netconfc that occurred when the remote server closed the SSH connection during NETCONF subsystem negotiation. Own Id: OTP-20191\ Related Id(s): ERIERL-1333, [PR-11230] > #### Full runtime dependencies of common_test-1.30.0.1 > > compiler-6.0, crypto-4.5, debugger-4.1, erts-7.0, ftp-1.0, inets-6.0, kernel-8.4, observer-2.1, runtime_tools-1.8.16, sasl-2.5, snmp-5.1.2, ssh-4.0, stdlib-4.0, syntax_tools-1.7, tools-3.2, xmerl-1.3.8 #### crypto-5.8.3.1 The crypto-5.8.3.1 application can be applied independently of other applications on a full OTP 28 installation. ##### Fixed Bugs and Malfunctions - `crypto:compute_key/4` for `eddh` and `crypto:generate_key/2,3` for `eddh`/`eddsa` now raise an `error:{notsup, Info, Description}` exception instead of returning the atom `notsup` when the underlying cryptolib lacks support. Own Id: OTP-20215\ Related Id(s): [PR-11302] > #### Full runtime dependencies of crypto-5.8.3.1 > > erts-9.0, kernel-6.0, stdlib-3.9 #### erts-16.4.0.3 The erts-16.4.0.3 application can be applied independently of other applications on a full OTP 28 installation. ##### Fixed Bugs and Malfunctions - Fixed an undefined behavior in the internal `erts_qsort()` function, which could have been the cause of a beam crash seen when updating large maps. Own Id: OTP-20185\ Related Id(s): [PR-11215] - Calculating `bxor` of the largest supported positive integer (`erlang:system_info(max_integer)`) and `-1` would return `[]` instead of a raising a `system_limit` exception. Own Id: OTP-20208\ Related Id(s): [PR-11269] - Fix possible race between `ets:delete/1` and terminating process with a fixation on the same table. Own Id: OTP-20217\ Related Id(s): [PR-11283] - A few code generation issues for the JIT on AArch64 (ARM64) have been fixed. For all platforms, the loader will reject some invalid BEAM files earlier. Own Id: OTP-20226\ Related Id(s): [PR-11299] ##### Improvements and New Features - Arithmetic operations on large integers will now increase the reduction _[Truncated at 4000 characters — full notes: https://github.com/erlang/otp/releases/tag/OTP-28.5.0.3]_ ### OTP-29.0.3 — OTP 29.0.3 - Date: 2026-07-02 - Version: OTP-29.0.3 - Original notes: https://github.com/erlang/otp/releases/tag/OTP-29.0.3 - Permalink: https://whatsnew.fyi/product/erlang-otp/releases/otp-29.0.3 - **fixed** — Fixed a crash in ct_netconfc that occurred when the remote server closed the SSH connection during NETCONF subsystem negotiation - **fixed** — Fixed several compiler bugs that could crash the compiler or generate incorrect code in rare circumstances - **changed** — crypto:compute_key/4 for eddh and crypto:generate_key/2,3 for eddh/eddsa now raise an error:{notsup, Info, Description} exception instead of returning the atom notsup when the underlying cryptolib lacks support - **fixed** — Fixed a bug with native record sets in erl_types.erl - **fixed** — Fixed an undefined behavior in the internal erts_qsort() function, which could have been the cause of a beam crash seen when updating large maps - **fixed** — Fixed bxor of the largest supported positive integer (erlang:system_info(max_integer)) and -1 to raise a system_limit exception instead of returning [] - **fixed** — Fixed possible race between ets:delete/1 and terminating process with a fixation on the same table - **fixed** — Fixed code generation issues for the JIT on AArch64 (ARM64) - **changed** — The loader will reject some invalid BEAM files earlier - **fixed** — On 32-bit computers, the md5 BIFs now return the correct MD5 checksum for data of size 4GiB or more - **fixed** — Fixed inet:info/1 crash when calling for a closing (port) socket - **fixed** — Fixed handling of the truncation bit in inet_res so it properly falls back to querying over TCP after a truncated UDP reply ``` Patch Package: OTP 29.0.3 Git Tag: OTP-29.0.3 Date: 2026-07-02 Trouble Report Id: OTP-20173, OTP-20183, OTP-20185, OTP-20186, OTP-20190, OTP-20191, OTP-20194, OTP-20196, OTP-20197, OTP-20198, OTP-20199, OTP-20200, OTP-20201, OTP-20206, OTP-20207, OTP-20208, OTP-20215, OTP-20216, OTP-20217, OTP-20220, OTP-20222, OTP-20226, OTP-20227, OTP-20230, OTP-20231, OTP-20232, OTP-20233 Seq num: CVE-2026-53422, CVE-2026-54886, CVE-2026-54887, CVE-2026-54891, CVE-2026-55950, CVE-2026-55952, ERIERL-1333, GH-SA-7wp4-pc27-2vj9, GH-SA-h9pw-h5w4-h976, PR-11209, PR-11215, PR-11219, PR-11230, PR-11239, PR-11244, PR-11247, PR-11250, PR-11259, PR-11268, PR-11269, PR-11270, PR-11271, PR-11281, PR-11282, PR-11283, PR-11289, PR-11294, PR-11295, PR-11299, PR-11302, PR-11306, PR-11307, PR-11309, PR-11311 System: OTP Release: 29 Application: common_test-1.31.1, compiler-10.0.2, crypto-5.9.1, dialyzer-6.0.2, erts-17.0.3, kernel-11.0.3, public_key-1.21.3, ssh-6.0.2, ssl-11.7.3, stdlib-8.0.2 Predecessor: OTP 29.0.2 ``` Check out the git tag OTP-29.0.3, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below. #### common_test-1.31.1 The common_test-1.31.1 application can be applied independently of other applications on a full OTP 29 installation. ##### Fixed Bugs and Malfunctions - Fixed a crash in ct_netconfc that occurred when the remote server closed the SSH connection during NETCONF subsystem negotiation. Own Id: OTP-20191\ Related Id(s): ERIERL-1333, [PR-11230] > #### Full runtime dependencies of common_test-1.31.1 > > compiler-10.0, crypto-4.5, debugger-4.1, erts-7.0, ftp-1.0, inets-6.0, kernel-11.0, observer-2.1, runtime_tools-1.8.16, sasl-2.5, snmp-5.1.2, ssh-4.0, stdlib-8.0, syntax_tools-1.7, tools-3.2, xmerl-1.3.8 #### compiler-10.0.2 The compiler-10.0.2 application can be applied independently of other applications on a full OTP 29 installation. ##### Fixed Bugs and Malfunctions - Several compiler bugs that could crash the compiler or generate incorrect code in rare circumstances have been fixed. Own Id: OTP-20222\ Related Id(s): [PR-11219] > #### Full runtime dependencies of compiler-10.0.2 > > crypto-5.1, erts-13.0, kernel-8.4, stdlib-8.0 #### crypto-5.9.1 The crypto-5.9.1 application can be applied independently of other applications on a full OTP 29 installation. ##### Fixed Bugs and Malfunctions - `crypto:compute_key/4` for `eddh` and `crypto:generate_key/2,3` for `eddh`/`eddsa` now raise an `error:{notsup, Info, Description}` exception instead of returning the atom `notsup` when the underlying cryptolib lacks support. Own Id: OTP-20215\ Related Id(s): [PR-11302] > #### Full runtime dependencies of crypto-5.9.1 > > erts-9.0, kernel-6.0, stdlib-3.9 #### dialyzer-6.0.2 The dialyzer-6.0.2 application can be applied independently of other applications on a full OTP 29 installation. ##### Fixed Bugs and Malfunctions - Fix a bug with native record sets in `erl_types.erl` Own Id: OTP-20201 > #### Full runtime dependencies of dialyzer-6.0.2 > > compiler-10.0, erts-12.0, kernel-8.0, stdlib-5.0, syntax_tools-2.0 #### erts-17.0.3 The erts-17.0.3 application can be applied independently of other applications on a full OTP _[Truncated at 4000 characters — full notes: https://github.com/erlang/otp/releases/tag/OTP-29.0.3]_ ### OTP-29.0.2 — OTP 29.0.2 - Date: 2026-06-10 - Version: OTP-29.0.2 - Original notes: https://github.com/erlang/otp/releases/tag/OTP-29.0.2 - Permalink: https://whatsnew.fyi/product/erlang-otp/releases/otp-29.0.2 - **fixed** — Fix native record bugs in Dialyzer - **fixed** — Fixed return value documentation of diameter:service_info(SvcName, statistics) - **security** — Fixed stack overflow in ei_s_print_term for very big integer terms (> 2000 hexadecimal digits long) - **security** — Fixed buffer overflow error when parsing SCTP ERROR or ABORT chunks that could lead to stack corruption and VM crash - **security** — FTP client default connections in passive mode now properly validates the response IP of the server to prevent server-side request forgery and FTP bounce attacks - **fixed** — The HTTP client (httpc) now removes Authorization, Proxy-Authorization, Cookie, Referer, and Origin headers when following a redirect to a different host or port - **fixed** — gen_tcp_socket accept should explicitly inherit the same options as plain gen_tcp - **fixed** — Fixed docs of mnesia:write/3 to clarify when a transaction can terminate ``` Patch Package: OTP 29.0.2 Git Tag: OTP-29.0.2 Date: 2026-06-10 Trouble Report Id: OTP-20057, OTP-20149, OTP-20150, OTP-20151, OTP-20153, OTP-20154, OTP-20155, OTP-20156, OTP-20160, OTP-20161, OTP-20162, OTP-20163, OTP-20165, OTP-20166, OTP-20170, OTP-20172, OTP-20174, OTP-20178, OTP-20181 Seq num: CVE-2026-48855, CVE-2026-48856, CVE-2026-48858, CVE-2026-48859, CVE-2026-48860, CVE-2026-49759, CVE-2026-49760, GH-11104, GH-11105, GH-11152, GH-SA-24cv-hwgr-37fq, GH-SA-3w6p-vwhf-wvp4, GH-SA-6f4f-chj5-5g97, GH-SA-gp7x-mfv6-52cv, GH-SA-m75x-4vwg-ggjh, GH-SA-pv7g-pjrq-x2fh, GH-SA-xcxj-5pg2-v72j, PR-11141, PR-11145, PR-11146, PR-11148, PR-11154, PR-11157, PR-11168, PR-11181, PR-11186, PR-11192, PR-11193, PR-11195, PR-11199, PR-11205, PR-11212, PR-1234, PR-27384 System: OTP Release: 29 Application: dialyzer-6.0.1, diameter-2.7.1, erl_interface-5.8.1, erts-17.0.2, ftp-1.2.6, inets-9.7.1, kernel-11.0.2, mnesia-4.26.1, public_key-1.21.2, ssh-6.0.1, ssl-11.7.2, stdlib-8.0.1, tools-4.2.1 Predecessor: OTP 29.0.1 ``` Check out the git tag OTP-29.0.2, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below. #### dialyzer-6.0.1 The dialyzer-6.0.1 application can be applied independently of other applications on a full OTP 29 installation. ##### Fixed Bugs and Malfunctions - Fix native record bugs in Dialyzer Own Id: OTP-20178\ Related Id(s): [PR-11199] > #### Full runtime dependencies of dialyzer-6.0.1 > > compiler-10.0, erts-12.0, kernel-8.0, stdlib-5.0, syntax_tools-2.0 #### diameter-2.7.1 The diameter-2.7.1 application can be applied independently of other applications on a full OTP 29 installation. ##### Fixed Bugs and Malfunctions - Fixed return value documentation of `diameter:service_info(SvcName, statistics)` Own Id: OTP-20150\ Related Id(s): [GH-11105], [PR-11146] > #### Full runtime dependencies of diameter-2.7.1 > > erts-10.0, kernel-3.2, ssl-9.0, stdlib-5.0 #### erl_interface-5.8.1 The erl_interface-5.8.1 application can be applied independently of other applications on a full OTP 29 installation. ##### Fixed Bugs and Malfunctions - Fixed stack overflow in `ei_s_print_term` for very big integer terms (> 2000 hexadecimal digits long). Own Id: OTP-20160\ Related Id(s): [GH-SA-xcxj-5pg2-v72j], [PR-11193], [CVE-2026-49760] #### erts-17.0.2 The erts-17.0.2 application can be applied independently of other applications on a full OTP 29 installation. ##### Fixed Bugs and Malfunctions - A buffer overflow error when parsing SCTP ERROR or ABORT chunks has been fixed. This could lead to stack corruption and VM crash, but ultimately with hard work by an attacker be refined into maybe even remote code execution. Own Id: OTP-20165\ Related Id(s): [GH-SA-6f4f-chj5-5g97], [PR-1234], [CVE-2026-49759] > #### Full runtime dependencies of erts-17.0.2 > > kernel-9.0, sasl-3.3, stdlib-4.1 #### ftp-1.2.6 The ftp-1.2.6 application can be applied independently of other applications on a full OTP 29 installation. ##### Fixed Bugs and Malfunctions - FTP client default connections that use the so called passive mode of FTP fails _[Truncated at 4000 characters — full notes: https://github.com/erlang/otp/releases/tag/OTP-29.0.2]_