# Erlang/OTP OTP-28.5.0.3 — OTP 28.5.0.3 - Product: Erlang/OTP (https://whatsnew.fyi/product/erlang-otp) - Vendor: Ericsson - Date: 2026-07-02 - Version: OTP-28.5.0.3 - Original notes: https://github.com/erlang/otp/releases/tag/OTP-28.5.0.3 - Permalink: https://whatsnew.fyi/product/erlang-otp/releases/otp-28.5.0.3 What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. --- - **fixed** — Fixed a crash in ct_netconfc that occurred when the remote server closed the SSH connection during NETCONF subsystem negotiation - **fixed** — crypto:compute_key/4 for eddh and crypto:generate_key/2,3 for eddh/eddsa now raise an error:{notsup, Info, Description} exception instead of returning the atom notsup when the underlying cryptolib lacks support - **fixed** — Fixed an undefined behavior in the internal erts_qsort() function, which could have been the cause of a beam crash seen when updating large maps - **fixed** — Calculating bxor of the largest supported positive integer (erlang:system_info(max_integer)) and -1 would return [] instead of raising a system_limit exception - **fixed** — Fix possible race between ets:delete/1 and terminating process with a fixation on the same table - **fixed** — A few code generation issues for the JIT on AArch64 (ARM64) have been fixed - **changed** — Arithmetic operations on large integers will now increase the reduction count for the process, causing context switches to occur more frequently when doing arithmetic on large integers - **fixed** — inet:info/1 could crash when calling for a closing (port) socket - **fixed** — Handling of the truncation bit in inet_res has been fixed so it properly falls back to querying over TCP after a truncated UDP reply - **fixed** — Hardened OCSP response verification by using constant-time hash comparisons and rejecting responses exceeding 100 KB before ASN.1 decoding ``` Patch Package: OTP 28.5.0.3 Git Tag: OTP-28.5.0.3 Date: 2026-07-02 Trouble Report Id: OTP-20173, OTP-20183, OTP-20185, OTP-20186, OTP-20190, OTP-20191, OTP-20194, OTP-20196, OTP-20197, OTP-20199, OTP-20200, OTP-20206, OTP-20207, OTP-20208, OTP-20211, OTP-20215, OTP-20216, OTP-20217, OTP-20220, OTP-20226, OTP-20230, OTP-20231, OTP-20232 Seq num: CVE-2026-53422, CVE-2026-54886, CVE-2026-54887, CVE-2026-54891, CVE-2026-55950, CVE-2026-55952, ERIERL-1333, GH-SA-7wp4-pc27-2vj9, GH-SA-h9pw-h5w4-h976, PR-11209, PR-11215, PR-11230, PR-11239, PR-11247, PR-11250, PR-11259, PR-11268, PR-11269, PR-11270, PR-11271, PR-11274, PR-11282, PR-11283, PR-11294, PR-11295, PR-11299, PR-11302, PR-11306, PR-11307, PR-11309, PR-11311 System: OTP Release: 28 Application: common_test-1.30.0.1, crypto-5.8.3.1, erts-16.4.0.3, kernel-10.6.3.3, public_key-1.20.3.3, ssh-5.5.2.2, ssl-11.6.0.3 Predecessor: OTP 28.5.0.2 ``` Check out the git tag OTP-28.5.0.3, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below. #### common_test-1.30.0.1 The common_test-1.30.0.1 application can be applied independently of other applications on a full OTP 28 installation. ##### Fixed Bugs and Malfunctions - Fixed a crash in ct_netconfc that occurred when the remote server closed the SSH connection during NETCONF subsystem negotiation. Own Id: OTP-20191\ Related Id(s): ERIERL-1333, [PR-11230] > #### Full runtime dependencies of common_test-1.30.0.1 > > compiler-6.0, crypto-4.5, debugger-4.1, erts-7.0, ftp-1.0, inets-6.0, kernel-8.4, observer-2.1, runtime_tools-1.8.16, sasl-2.5, snmp-5.1.2, ssh-4.0, stdlib-4.0, syntax_tools-1.7, tools-3.2, xmerl-1.3.8 #### crypto-5.8.3.1 The crypto-5.8.3.1 application can be applied independently of other applications on a full OTP 28 installation. ##### Fixed Bugs and Malfunctions - `crypto:compute_key/4` for `eddh` and `crypto:generate_key/2,3` for `eddh`/`eddsa` now raise an `error:{notsup, Info, Description}` exception instead of returning the atom `notsup` when the underlying cryptolib lacks support. Own Id: OTP-20215\ Related Id(s): [PR-11302] > #### Full runtime dependencies of crypto-5.8.3.1 > > erts-9.0, kernel-6.0, stdlib-3.9 #### erts-16.4.0.3 The erts-16.4.0.3 application can be applied independently of other applications on a full OTP 28 installation. ##### Fixed Bugs and Malfunctions - Fixed an undefined behavior in the internal `erts_qsort()` function, which could have been the cause of a beam crash seen when updating large maps. Own Id: OTP-20185\ Related Id(s): [PR-11215] - Calculating `bxor` of the largest supported positive integer (`erlang:system_info(max_integer)`) and `-1` would return `[]` instead of a raising a `system_limit` exception. Own Id: OTP-20208\ Related Id(s): [PR-11269] - Fix possible race between `ets:delete/1` and terminating process with a fixation on the same table. Own Id: OTP-20217\ Related Id(s): [PR-11283] - A few code generation issues for the JIT on AArch64 (ARM64) have been fixed. For all platforms, the loader will reject some invalid BEAM files earlier. Own Id: OTP-20226\ Related Id(s): [PR-11299] ##### Improvements and New Features - Arithmetic operations on large integers will now increase the reduction _[Truncated at 4000 characters — full notes: https://github.com/erlang/otp/releases/tag/OTP-28.5.0.3]_