NewsBot

Erlang OTP-29.1.1, OTP-28.5.0.7 and OTP-27.3.4.18 released!

Erlang OTP-29.1.1, OTP-28.5.0.7 and OTP-27.3.4.18 has been released.

Patch Package:           OTP 29.1.1
Git Tag:                 OTP-29.1.1
Date:                    2026-09-22
Trouble Report Id:       OTP-20272, OTP-20287, OTP-20355, OTP-20371,
                         OTP-20386, OTP-20388, OTP-20390, OTP-20393
Seq num:                 CVE-2026-65634, CVE-2026-68956,
                         CVE-2026-89422, ERIERL-1355, ERIERL-1363,
                         GH-11586, GH-11619, GH-SA-qhcm-px9c-rvfh,
                         PR-11523, PR-11559, PR-11616, PR-11630,
                         PR-11638, PR-11641, PR-11651, PR-11655
System:                  OTP
Release:                 29
Application:             asn1-5.5.2, compiler-10.0.6,
                         public_key-1.21.7, ssh-6.0.6, ssl-11.7.7
Predecessor:             OTP 29.1
Check out the git tag OTP-29.1.1, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the ‘otp_patch_apply’ tool. For information on install requirements, see descriptions for each application version below.

POTENTIAL INCOMPATIBILITIES

Fixed a vulnerability where the max_channels daemon option was not enforced for session channels without an active subsystem, allowing a remote authenticated user to open an infinite number of channels and exhaust server resources despite the configured limit.

The default value of the max_channels daemon option has been changed from infinity to 256. Deployments requiring more than 256 simultaneous channels per connection can restore the previous behavior by setting {max_channels, infinity}.

The default value of the max_sessions daemon option has been changed from infinity to 1024. Deployments requiring more concurrent SSH connections can restore the previous behavior by setting {max_sessions, infinity}.

Own Id: OTP-20287
Application(s): ssh
Related Id(s): [GH-SA-qhcm-px9c-rvfh], [PR-11523], [CVE-2026-68956]

asn1-5.5.2

The asn1-5.5.2 application ca…

Link: Release OTP 29.1.1 · erlang/otp · GitHub

Patch Package:           OTP 28.5.0.7
Git Tag:                 OTP-28.5.0.7
Date:                    2026-09-22
Trouble Report Id:       OTP-20118, OTP-20256, OTP-20272, OTP-20287,
                         OTP-20327, OTP-20355, OTP-20358, OTP-20365,
                         OTP-20371, OTP-20386, OTP-20388, OTP-20390,
                         OTP-20393
Seq num:                 CVE-2026-65634, CVE-2026-68956,
                         CVE-2026-89422, ERIERL-1355, ERIERL-1356,
                         ERIERL-1361, ERIERL-1363, GH-11338, GH-11344,
                         GH-11534, GH-11586, GH-11619,
                         GH-SA-qhcm-px9c-rvfh, PR-11167, PR-11356,
                         PR-11426, PR-11523, PR-11559, PR-11566,
                         PR-11570, PR-11616, PR-11630, PR-11638,
                         PR-11641, PR-11651, PR-11655
System:                  OTP
Release:                 28
Application:             asn1-5.4.3.1, compiler-9.0.6.3,
                         mnesia-4.25.3.3, public_key-1.20.3.5,
                         ssh-5.5.2.6, ssl-11.6.0.6, stdlib-7.3.0.3
Predecessor:             OTP 28.5.0.6
Check out the git tag OTP-28.5.0.7, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the ‘otp_patch_apply’ tool. For information on install requirements, see descriptions for each application version below.

POTENTIAL INCOMPATIBILITIES
When beam_lib returns an error tuple, the filename in the information tuple is now a list of characters instead of an atom.

Example:
1> beam_lib:chunks(code:which(lists), ["nope"]).
{error,beam_lib,
       {missing_chunk,".../git/otp/lib/stdlib/ebin/lists.beam",
                      "nope"}}
The reason for this change is that a long file name is not guaranteed to fit in an atom. Applications or tools that do deep inspection of the beam_lib errors (not recommended) will need to be upda…