# Patch Package OTP 27.3.4.16 Released

**URL:** <https://erlangforums.com/t/patch-package-otp-27-3-4-16-released/5840>\
**Category:** Erlang News\
**Tags:** erlang-release\
**Created:** [August 4, 2026, 9:51am UTC](https://erlangforums.com/t/patch-package-otp-27-3-4-16-released/5840 "2026-08-04T09:51:42Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jhogberg](https://erlangforums.com/user_avatar/erlangforums.com/jhogberg/32/179_2.png) [@jhogberg](https://erlangforums.com/u/jhogberg)\
**Post date:** [August 4, 2026, 9:51am UTC](https://erlangforums.com/t/patch-package-otp-27-3-4-16-released/5840/1 "2026-08-04T09:51:42Z")

</div>

```erlang
Patch Package: OTP 27.3.4.16
Git Tag: OTP-27.3.4.16
Date: 2026-08-04
Trouble Report Id: OTP-20137, OTP-20275
Seq num: GH-11402, PR-11110, PR-11409
System: OTP
Release: 27
Application: erts-15.2.7.12, ssh-5.2.11.11
Predecessor: OTP 27.3.4.15

```

Check out the git tag OTP-27.3.4.16, and build a full OTP system including  
documentation. Apply one or more applications from this build as patches to your  
installation using the ‘otp\_patch\_apply’ tool. For information on install  
requirements, see descriptions for each application version below.

# erts-15.2.7.12

The erts-15.2.7.12 application can be applied independently of other  
applications on a full OTP 27 installation.

## Fixed Bugs and Malfunctions

- Fixed a regression in the previous patch release that prevented epmd from  
binding to localhost.

> #### Full runtime dependencies of erts-15.2.7.12
> 
> kernel-9.0, sasl-3.3, stdlib-4.1

# ssh-5.2.11.11

The ssh-5.2.11.11 application can be applied independently of other applications  
on a full OTP 27 installation.

## Fixed Bugs and Malfunctions

- The SSH client and server now reject incoming packets not aligned to the  
cipher block size as required by RFC 4253 §6. For CBC ciphers, a timing-safe  
“packet discard” mechanism (CVE-2008-5161 mitigation) ensures structural  
errors are indistinguishable from MAC failures before disconnecting. AEAD and  
encrypt-then-MAC modes disconnect immediately.

> #### Full runtime dependencies of ssh-5.2.11.11
> 
> crypto-5.0, erts-14.0, kernel-9.0, public\_key-1.6.1, runtime\_tools-1.15.1,  
> stdlib-5.0, stdlib-6.0

---

<div class="post-metadata">

**Author:** ![jhogberg](https://erlangforums.com/user_avatar/erlangforums.com/jhogberg/32/179_2.png) [@jhogberg](https://erlangforums.com/u/jhogberg)\
**Post date:** [August 4, 2026, 9:51am UTC](https://erlangforums.com/t/patch-package-otp-27-3-4-16-released/5840/3 "2026-08-04T09:51:50Z")

</div>

Pinned on August 4, 2026, 9:51am UTC