Patch Package OTP 26.2.5.20 Released

Erlang News & Announcements Erlang News
1

Patch Package: OTP 26.2.5.20
Git Tag: OTP-26.2.5.20
Date: 2026-04-21
Trouble Report Id: OTP-20081, OTP-20101
Seq num: CVE-2026-32147, GH-10667, PR-11027
System: OTP
Release: 26
Application: erts-14.2.5.14, ssh-5.1.4.15
Predecessor: OTP 26.2.5.19

Check out the git tag OTP-26.2.5.20, and build a full OTP system
including documentation. Apply one or more applications from this
build as patches to your installation using the ‘otp_patch_apply’
tool. For information on install requirements, see descriptions for
each application version below.

— erts-14.2.5.14 --------------------------------------------------

The erts-14.2.5.14 application can be applied independently of other
applications on a full OTP 26 installation.

— Fixed Bugs and Malfunctions —

OTP-20101 Application(s): erts
Related Id(s): GH-10667

           Fixed an issue when supplying the args_file option to
           erl.exe on windows that did not handle unicode
           characters correctly.

Full runtime dependencies of erts-14.2.5.14: kernel-9.0, sasl-3.3,
stdlib-4.1

— ssh-5.1.4.15 ----------------------------------------------------

The ssh-5.1.4.15 application can be applied independently of other
applications on a full OTP 26 installation.

— Fixed Bugs and Malfunctions —

OTP-20081 Application(s): ssh
Related Id(s): PR-11027, CVE-2026-32147

           Fixed a vulnerability in the SFTP server where file
           attributes could be modified outside the configured
           root directory. When using FSETSTAT on an open file
           handle, the operation used the path stored in the
           handle without verifying it was within the root
           directory, allowing attribute changes to files outside
           the chroot boundary.

           Thanks to John Downey.

Full runtime dependencies of ssh-5.1.4.15: crypto-5.0, erts-14.0,
kernel-9.0, public_key-1.6.1, runtime_tools-1.15.1, stdlib-5.0,
stdlib-5.0

1 Like