# Erlang/OTP OTP-29.0.2 — OTP 29.0.2

- Product: Erlang/OTP (https://whatsnew.fyi/product/erlang-otp)
- Vendor: Ericsson
- Date: 2026-06-10
- Version: OTP-29.0.2
- Original notes: https://github.com/erlang/otp/releases/tag/OTP-29.0.2
- Permalink: https://whatsnew.fyi/product/erlang-otp/releases/otp-29.0.2

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **fixed** — Fix native record bugs in Dialyzer
- **fixed** — Fixed return value documentation of diameter:service_info(SvcName, statistics)
- **security** — Fixed stack overflow in ei_s_print_term for very big integer terms (> 2000 hexadecimal digits long)
- **security** — Fixed buffer overflow error when parsing SCTP ERROR or ABORT chunks that could lead to stack corruption and VM crash
- **security** — FTP client default connections in passive mode now properly validates the response IP of the server to prevent server-side request forgery and FTP bounce attacks
- **fixed** — The HTTP client (httpc) now removes Authorization, Proxy-Authorization, Cookie, Referer, and Origin headers when following a redirect to a different host or port
- **fixed** — gen_tcp_socket accept should explicitly inherit the same options as plain gen_tcp
- **fixed** — Fixed docs of mnesia:write/3 to clarify when a transaction can terminate

```
Patch Package:           OTP 29.0.2
Git Tag:                 OTP-29.0.2
Date:                    2026-06-10
Trouble Report Id:       OTP-20057, OTP-20149, OTP-20150, OTP-20151,
                         OTP-20153, OTP-20154, OTP-20155, OTP-20156,
                         OTP-20160, OTP-20161, OTP-20162, OTP-20163,
                         OTP-20165, OTP-20166, OTP-20170, OTP-20172,
                         OTP-20174, OTP-20178, OTP-20181
Seq num:                 CVE-2026-48855, CVE-2026-48856,
                         CVE-2026-48858, CVE-2026-48859,
                         CVE-2026-48860, CVE-2026-49759,
                         CVE-2026-49760, GH-11104, GH-11105, GH-11152,
                         GH-SA-24cv-hwgr-37fq, GH-SA-3w6p-vwhf-wvp4,
                         GH-SA-6f4f-chj5-5g97, GH-SA-gp7x-mfv6-52cv,
                         GH-SA-m75x-4vwg-ggjh, GH-SA-pv7g-pjrq-x2fh,
                         GH-SA-xcxj-5pg2-v72j, PR-11141, PR-11145,
                         PR-11146, PR-11148, PR-11154, PR-11157,
                         PR-11168, PR-11181, PR-11186, PR-11192,
                         PR-11193, PR-11195, PR-11199, PR-11205,
                         PR-11212, PR-1234, PR-27384
System:                  OTP
Release:                 29
Application:             dialyzer-6.0.1, diameter-2.7.1,
                         erl_interface-5.8.1, erts-17.0.2, ftp-1.2.6,
                         inets-9.7.1, kernel-11.0.2, mnesia-4.26.1,
                         public_key-1.21.2, ssh-6.0.1, ssl-11.7.2,
                         stdlib-8.0.1, tools-4.2.1
Predecessor:             OTP 29.0.1
```

Check out the git tag OTP-29.0.2, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.

#### dialyzer-6.0.1

The dialyzer-6.0.1 application can be applied independently of other applications on a full OTP 29 installation.

##### Fixed Bugs and Malfunctions

- Fix native record bugs in Dialyzer

  Own Id: OTP-20178\
  Related Id(s): [PR-11199]

> #### Full runtime dependencies of dialyzer-6.0.1
>
> compiler-10.0, erts-12.0, kernel-8.0, stdlib-5.0, syntax_tools-2.0

#### diameter-2.7.1

The diameter-2.7.1 application can be applied independently of other applications on a full OTP 29 installation.

##### Fixed Bugs and Malfunctions

- Fixed return value documentation of `diameter:service_info(SvcName, statistics)`

  Own Id: OTP-20150\
  Related Id(s): [GH-11105], [PR-11146]

> #### Full runtime dependencies of diameter-2.7.1
>
> erts-10.0, kernel-3.2, ssl-9.0, stdlib-5.0

#### erl_interface-5.8.1

The erl_interface-5.8.1 application can be applied independently of other applications on a full OTP 29 installation.

##### Fixed Bugs and Malfunctions

- Fixed stack overflow in `ei_s_print_term` for very big integer terms (> 2000 hexadecimal digits long).

  Own Id: OTP-20160\
  Related Id(s): [GH-SA-xcxj-5pg2-v72j], [PR-11193], [CVE-2026-49760]

#### erts-17.0.2

The erts-17.0.2 application can be applied independently of other applications on a full OTP 29 installation.

##### Fixed Bugs and Malfunctions

- A buffer overflow error when parsing SCTP ERROR or ABORT chunks has been fixed.

  This could lead to stack corruption and VM crash, but ultimately with hard work by an attacker be refined into maybe even remote code execution.

  Own Id: OTP-20165\
  Related Id(s): [GH-SA-6f4f-chj5-5g97], [PR-1234], [CVE-2026-49759]

> #### Full runtime dependencies of erts-17.0.2
>
> kernel-9.0, sasl-3.3, stdlib-4.1

#### ftp-1.2.6

The ftp-1.2.6 application can be applied independently of other applications on a full OTP 29 installation.

##### Fixed Bugs and Malfunctions

- FTP client default connections that use the so called passive mode of FTP fails

_[Truncated at 4000 characters — full notes: https://github.com/erlang/otp/releases/tag/OTP-29.0.2]_