# Patch Package OTP 27.3.4.18 Released **URL:** \ **Category:** Erlang News\ **Tags:** erlang-release\ **Created:** [September 22, 2026, 8:31am UTC](https://erlangforums.com/t/patch-package-otp-27-3-4-18-released/5963 "2026-09-22T08:31:58Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![jhogberg](https://erlangforums.com/user_avatar/erlangforums.com/jhogberg/32/179_2.png) [@jhogberg](https://erlangforums.com/u/jhogberg)\ **Post date:** [September 22, 2026, 8:31am UTC](https://erlangforums.com/t/patch-package-otp-27-3-4-18-released/5963/1 "2026-09-22T08:31:58Z")
```erlang Patch Package: OTP 27.3.4.18 Git Tag: OTP-27.3.4.18 Date: 2026-09-22 Trouble Report Id: OTP-20256, OTP-20272, OTP-20287, OTP-20327, OTP-20355, OTP-20358, OTP-20365, OTP-20367, OTP-20371, OTP-20384, OTP-20386, OTP-20388, OTP-20390 Seq num: CVE-2026-65634, CVE-2026-68956, CVE-2026-89422, ERIERL-1355, ERIERL-1356, ERIERL-1363, GH-11338, GH-11344, GH-11534, GH-11586, GH-11619, GH-SA-qhcm-px9c-rvfh, PR-11356, PR-11426, PR-11523, PR-11559, PR-11566, PR-11570, PR-11574, PR-11616, PR-11632, PR-11638, PR-11641, PR-11651, PR-11655 System: OTP Release: 27 Application: asn1-5.3.4.3, compiler-8.6.1.7, mnesia-4.23.5.5, public_key-1.17.1.6, ssh-5.2.11.13, ssl-11.2.12.13 Predecessor: OTP 27.3.4.17 ``` Check out the git tag OTP-27.3.4.18, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the ‘otp\_patch\_apply’ tool. For information on install requirements, see descriptions for each application version below. # POTENTIAL INCOMPATIBILITIES - Fixed a vulnerability where the `max_channels` daemon option was not enforced for session channels without an active subsystem, allowing a remote authenticated user to open an infinite number of channels and exhaust server resources despite the configured limit. # asn1-5.3.4.3 The asn1-5.3.4.3 application can be applied independently of other applications on a full OTP 27 installation. ## Fixed Bugs and Malfunctions - Fixed a denial-of-service attack in asn1, where abnormally large OID components (arcs) could cause resource exhaustion. - The JER backend will no longer break certain values (true, false, null) when they are typed as ENUMERATED, they will now be encoded as strings as required by the standard. > #### Full runtime dependencies of asn1-5.3.4.3 > > erts-14.0, kernel-9.0, stdlib-5.0 # compiler-8.6.1.7 The compiler-8.6.1.7 application can be applied independently of other applications on a full OTP 27 installation. ## Fixed Bugs and Malfunctions - In rare circumstances, the type analysis pass of the compiler could run for many minutes. - Certain uses of funs could crash the compiler. For example: > #### Full runtime dependencies of compiler-8.6.1.7 > > crypto-5.1, erts-13.0, kernel-8.4, stdlib-6.0 # mnesia-4.23.5.5 The mnesia-4.23.5.5 application can be applied independently of other applications on a full OTP 27 installation. ## Fixed Bugs and Malfunctions - Fixed `mnesia:force_load_table/1` getting stuck when the remote node becomes unreachable during table loading. When a network loader is aborted due to sender node going down and a user has forced a table load, we now retry loading from disc instead. Additionally, for disc\_only\_copies tables, the process actually loading the table is the dets server process, not the mnesia loader, so it would not receive the abort notification and would hang indefinitely. Now it correctly receives the notification and aborts table loading. > #### Full runtime dependencies of mnesia-4.23.5.5 > > erts-9.0, kernel-5.3, stdlib-5.0 # public\_key-1.17.1.6 The public\_key-1.17.1.6 application can be applied independently of other applications on a full OTP 27 installation. ## Fixed Bugs and Malfunctions - Align moduli and pubkey\_moduli.hrl to state on OTP-28 and newer. > #### Full runtime dependencies of public\_key-1.17.1.6 > > asn1-5.0, crypto-5.0, erts-13.0, kernel-8.0, stdlib-4.0 # ssh-5.2.11.13 The ssh-5.2.11.13 application can be applied independently of other applications on a full OTP 27 installation. ## Fixed Bugs and Malfunctions - Fixed a vulnerability where the `max_channels` daemon option was not enforced for session channels without an active subsystem, allowing a remote authenticated user to open an infinite number of channels and exhaust server resources despite the configured limit. - The SSH daemon no longer rejects a `subsystem` request that is preceded by `env` or `pty-req` request on the same channel. > #### Full runtime dependencies of ssh-5.2.11.13 > > crypto-5.0, erts-14.0, kernel-9.0, public\_key-1.6.1, runtime\_tools-1.15.1, > stdlib-5.0, stdlib-6.0 # ssl-11.2.12.13 Note! The ssl-11.2.12.13 application _cannot_ be applied independently of other applications on an arbitrary OTP 27 installation. ``` On a full OTP 27 installation, also the following runtime dependency has to be satisfied: -- public_key-1.17.1.3 (first satisfied in OTP 27.3.4.12) ``` ## Fixed Bugs and Malfunctions - Undecodable `certificate_authorities` names are now skipped, as they are just a hint. - Corrected generated keylog information generated from the `keylog_hs` option in the corner case that it was invoked after the client had reached its connection state, but the server closed the connection before it reached its connection state. - Fix restart bug for TLS-1.3 session ticket server, introduced by backport commit in OTP-27.3.4.14, would case a restart to fail due to wrong number of arguments. - Reject unsolicited TLS-1.3 pre\_shared\_key in client. - Security and robustness hardening returning RFC mandated alert reasons, narrowing/correcting length checks. > #### Full runtime dependencies of ssl-11.2.12.13 > > crypto-5.1, erts-15.0, inets-5.10.7, kernel-9.0, public\_key-1.17.1.3, > runtime\_tools-1.15.1, stdlib-6.0 # Thanks to Alex Nogueira, ausimian