- erts-17.0.5 updated with unspecified changes
- ssh-6.0.4 updated with unspecified changes
advisories
Erlang/OTP
language23 releases · 12 support linesSupport lines
LTS status and end of life
| Line | Latest | Status | End of life |
|---|---|---|---|
| 29 | 29.0.5 | supported | 11 May 2029 |
| 28 | 28.5.0.5 | supported | 20 May 2028 |
| 27 | 27.3.4.16 | supported | 20 May 2027 |
| 26 | 26.2.5.21 | eol | 26 May 2026 |
| 25 | 25.3.2.21 | eol | 17 May 2025 |
| 24 | 24.3.4.17 | eol | 10 May 2024 |
| 23 | 23.3.4.20 | eol | 14 Mar 2024 |
| 22 | 22.3.4.27 | eol | 18 Mar 2024 |
| 21 | 21.3.8.24 | eol | 19 Jun 2021 |
| 20 | 20.3.8.26 | eol | 21 Jun 2020 |
| 19 | 19.3.6.13 | eol | 21 Jun 2019 |
| 18 | 18.3.4.11 | eol | 9 Nov 2018 |
Releases
newest first
changelog ↗
- Fixed multiple security vulnerabilities including denial of service in epmd, crafted ETF payload crashes, and certificate chain validation issues
- Patched buffer overflow in megaco flex scanner and zip file path traversal vulnerability
- Fixed crashes and infinite loops in diameter, crypto, and SSL/TLS implementations
- Corrected heap corruption when decoding invalid tuples and improved DH key exchange validation
what breaks
Fixed heap corruption when decoding invalidly encoded tuples from External Term Format (binary_to_term) - code relying on previous behavior with malformed tuples may be affected. DH-GEX key exchange now enforces stricter validation of group parameters, rejecting groups with P < 2048 bits.
to upgrade
ssl-11.7.4 cannot be applied independently; requires public_key-1.21.1 or later (first satisfied in OTP 29.0.1). Use 'otp_patch_apply' tool to apply patches to your OTP 29 installation.
- Multiple security vulnerabilities fixed in SSH, SSL/TLS, and cryptographic operations
- Compiler bugs that could crash or generate incorrect code have been resolved
- SFTP server now properly isolates root directories and prevents excessive memory allocation
- Various race conditions and edge cases in networking, ETS, and TLS handshakes fixed
what breaks
SSH servers will reject SHA-1 user-auth signatures from OpenSSH 7.x clients when rsa-sha2-* is negotiated. Extremely old unpatched OpenSSH builds (10+ years old) will fail authentication and must be upgraded.
to upgrade
ssl-11.7.3 requires public_key-1.21.1 or later (first satisfied in OTP 29.0.1). All other applications can be applied independently to a full OTP 29 installation.
- Fixed multiple security vulnerabilities including buffer overflow in SCTP parsing, FTP SSRF attacks, SSH username enumeration, and credential leakage in HTTP redirects
- Fixed stack overflow in erl_interface when handling very large integer terms
- Fixed SSH symlink path disclosure and race condition in keep-alive handling
- Fixed various bugs in dialyzer, stdlib record operations, and TLS/SSL configuration
advisories
- Security fixes for certificate validation in public_key and SSL, including RFC 9525 compliance for hostname checking and RFC 5280 path validation
- Bug fixes for compiler optimization of boolean expressions and native record handling
- SCTP IPv6 socket option inheritance and SNMP error response handling corrected
- Runtime system fix for native record comparison that could crash or return incorrect results
what breaks
public_key and ssl no longer support legacy fallback to check hostname against subject common name; they now strictly adhere to RFC 9525. Error handling behavior has changed in both applications. Code relying on the old hostname checking behavior or expecting specific error types will break.
to upgrade
Apply public_key-1.21.1 and ssl-11.7.1 together. Note that ssl-11.7.1 requires public_key-1.21.1 and cannot be applied independently to arbitrary OTP 29 installations.
advisories
- Bug fixes and updates to the Erlang runtime system (erts)
- Bug fixes and updates to the SSH application
advisories
- Bug fixes and patches applied to crypto, diameter, erts, megaco, public_key, ssh, ssl, and stdlib libraries
- Multiple security vulnerabilities fixed in SSH, SSL/TLS, and cryptographic operations
- Fixed crashes and undefined behavior in ERTS (Erlang runtime), including map updates and ETS operations
- Improved performance of large integer arithmetic with better reduction counting
- Fixed SFTP server path traversal vulnerability and excessive memory allocation issues
what breaks
SSH clients using 10-year-old unpatched OpenSSH 7.x builds with a distro-specific issue will fail authentication after a server-side workaround was removed (OTP-20206). These clients must upgrade.
to upgrade
Apply patches from OTP 28.5.0.3 using the otp_patch_apply tool. Note that public_key-1.20.3.3 and ssh-5.5.2.2 have specific runtime dependency requirements on crypto versions.
- Multiple security vulnerabilities fixed across SSH, FTP, HTTP client, ERTS, and erl_interface
- HTTP client now properly removes sensitive headers (Authorization, Cookie, etc.) when redirecting to different hosts
- Fixed SSH symlink path disclosure vulnerability and FTP server redirect validation
- Various bug fixes in Dialyzer, ETS, SSL/TLS, and other components
advisories
- erts runtime system updated to version 15.2.7.12
- ssh application updated to version 5.2.11.11
- Patch updates to crypto, diameter, erts, megaco, public_key, ssh, ssl, and stdlib libraries
- Bug fixes and patches to common_test, crypto, erts, public_key, ssh, and ssl applications
- Bug fixes and updates across multiple applications including dialyzer, diameter, erl_interface, erts, ftp, inets, mnesia, ssh, and ssl
No changelog text published for this release.
changelog ↗No changelog text published for this release.
changelog ↗No changelog text published for this release.
changelog ↗No changelog text published for this release.
changelog ↗No changelog text published for this release.
changelog ↗No changelog text published for this release.
changelog ↗No changelog text published for this release.
changelog ↗No changelog text published for this release.
changelog ↗No changelog text published for this release.
changelog ↗No changelog text published for this release.
changelog ↗