Erlang OTP-28.0.3, OTP-27.3.4.3 and OTP-26.2.5.15 released!

NewsBot · 10 September 2025 15:24

Erlang OTP-28.0.3, OTP-27.3.4.3 and OTP-26.2.5.15 has been released.

Patch Package:           OTP 28.0.3
Git Tag:                 OTP-28.0.3
Date:                    2025-09-10
Trouble Report Id:       OTP-19701, OTP-19741, OTP-19742, OTP-19748,
                         OTP-19753, OTP-19755, OTP-19761
Seq num:                 CVE-2025-48038, CVE-2025-48039,
                         CVE-2025-48040, CVE-2025-48041,
                         CVE-2025-58050, PR-10155, PR-10156, PR-10157,
                         PR-10162, PR-19755, PR-9815
System:                  OTP
Release:                 28
Application:             diameter-2.5.1, erts-16.0.3, ssh-5.3.3,
                         stdlib-7.0.3
Predecessor:             OTP 28.0.2
Check out the git tag OTP-28.0.3, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the ‘otp_patch_apply’ tool. For information on install requirements, see descriptions for each application version below.

POTENTIAL INCOMPATIBILITIES

Option max_handles can be configured for sshd running SFTP. The positive integer value limits amount of file handles opened for a connection (by default 4096 is used).

Own Id: OTP-19701
Application(s): ssh
Related Id(s): [PR-10157], [CVE-2025-48041]

Avoid decoding KEX messages providing too many algorithms. This change does not introduce new limitation but assures it is enforced earlier in processing chain. Adjustments in error logging during handshake.

Own Id: OTP-19741
Application(s): ssh
Related Id(s): [PR-10162], [CVE-2025-48040]

A new ‘max_path’ option is now available in the sshd configuration, allowing administrators to set the maximum allowable path length. By default, this value is set to 4096 characters.

Own Id: OTP-19742
Application(s): ssh
Related Id(s): [PR-10155], [CVE-2025-48039]

Reject file handles exceeding size specified in RFCs (256 bytes).

Own Id: OTP-19748
Application(s): ssh
Related Id(s): [PR-10156], [CVE-2025-…

Link: Release OTP 28.0.3 · erlang/otp · GitHub

Patch Package:           OTP 27.3.4.3
Git Tag:                 OTP-27.3.4.3
Date:                    2025-09-10
Trouble Report Id:       OTP-19701, OTP-19719, OTP-19722, OTP-19728,
                         OTP-19729, OTP-19740, OTP-19741, OTP-19742,
                         OTP-19748, OTP-19760
Seq num:                 CVE-2025-48038, CVE-2025-48039,
                         CVE-2025-48040, CVE-2025-48041, GH-10057,
                         GH-10065, GH-10072, GH-10077, GH-10103,
                         GH-3392, PR-10066, PR-10090, PR-10093,
                         PR-10118, PR-10120, PR-10155, PR-10156,
                         PR-10157, PR-10162, PR-6223
System:                  OTP
Release:                 27
Application:             compiler-8.6.1.2, debugger-5.5.0.1,
                         erts-15.2.7.2, inets-9.3.2.1, ssh-5.2.11.3,
                         syntax_tools-3.2.2.1
Predecessor:             OTP 27.3.4.2
Check out the git tag OTP-27.3.4.3, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the ‘otp_patch_apply’ tool. For information on install requirements, see descriptions for each application version below.

POTENTIAL INCOMPATIBILITIES

Option max_handles can be configured for sshd running SFTP. The positive integer value limits amount of file handles opened for a connection (by default 4096 is used).

Own Id: OTP-19701
Application(s): ssh
Related Id(s): [PR-10157], [CVE-2025-48041]

Avoid decoding KEX messages providing too many algorithms. This change does not introduce new limitation but assures it is enforced earlier in processing chain. Adjustments in error logging during handshake.

Own Id: OTP-19741
Application(s): ssh
Related Id(s): [PR-10162], [CVE-2025-48040]

A new ‘max_path’ option is now available in the sshd configuration, allowing administrators to set the maximum allowable path length. By default, this value…

Link: Release OTP 27.3.4.3 · erlang/otp · GitHub

Patch Package:           OTP 26.2.5.15
Git Tag:                 OTP-26.2.5.15
Date:                    2025-09-10
Trouble Report Id:       OTP-19701, OTP-19729, OTP-19741, OTP-19742,
                         OTP-19748, OTP-19760
Seq num:                 CVE-2025-48038, CVE-2025-48039,
                         CVE-2025-48040, CVE-2025-48041, GH-10065,
                         GH-3392, PR-10120, PR-10155, PR-10156,
                         PR-10157, PR-10162, PR-6223
System:                  OTP
Release:                 26
Application:             inets-9.1.0.3, ssh-5.1.4.12
Predecessor:             OTP 26.2.5.14

 Check out the git tag OTP-26.2.5.15, and build a full OTP system
 including documentation. Apply one or more applications from this
 build as patches to your installation using the 'otp_patch_apply'
 tool. For information on install requirements, see descriptions for
 each application version below.

 ---------------------------------------------------------------------
 --- POTENTIAL INCOMPATIBILITIES -------------------------------------
 ---------------------------------------------------------------------

  OTP-19701    Application(s): ssh
               Related Id(s): PR-10157, CVE-2025-48041

               Option max_handles can be configured for sshd running
               SFTP. The positive integer value limits amount of file
               handles opened for a connection (by default 4096 is
               used).


  OTP-19741    Application(s): ssh
               Related Id(s): PR-10162, CVE-2025-48040

               Avoid decoding KEX messages providing too many
               algorithms. This change does not introduce new
               limitation but assures it is enforced earlier in
               processing chain. Adjustments in error logging during
               handshake.


  OTP-19742    Application(s): ssh
               Related Id(s): PR-10155, CVE-2025-48039

               A new 'max_path' option is now available in the sshd
...

Link: Release OTP 26.2.5.15 · erlang/otp · GitHub