# Patch Package OTP 27.3.4.8 Released **URL:** \ **Category:** Erlang News\ **Tags:** erlang-release\ **Created:** [February 20, 2026, 10:15am UTC](https://erlangforums.com/t/patch-package-otp-27-3-4-8-released/5447 "2026-02-20T10:15:09Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![raimo](https://erlangforums.com/user_avatar/erlangforums.com/raimo/32/867_2.png) [@raimo](https://erlangforums.com/u/raimo)\ **Post date:** [February 20, 2026, 10:15am UTC](https://erlangforums.com/t/patch-package-otp-27-3-4-8-released/5447/1 "2026-02-20T10:15:10Z")
```erlang Patch Package: OTP 27.3.4.8 Git Tag: OTP-27.3.4.8 Date: 2026-02-20 Trouble Report Id: OTP-19864, OTP-19962, OTP-19978, OTP-19981, OTP-19983, OTP-19988, OTP-19993 Seq num: CVE-2026-21620, GH-10651, GH-10705, GH-8676, PR-10575, PR-10616, PR-10664, PR-10696, PR-10706, PR-10708, PR-10732 System: OTP Release: 27 Application: crypto-5.5.3.1, erts-15.2.7.6, ssh-5.2.11.5, stdlib-6.2.2.3, tftp-1.2.2.1 Predecessor: OTP 27.3.4.7 ``` Check out the git tag OTP-27.3.4.8, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the ‘otp\_patch\_apply’ tool. For information on install requirements, see descriptions for each application version below. # crypto-5.5.3.1 The crypto-5.5.3.1 application can be applied independently of other applications on a full OTP 27 installation. ## Fixed Bugs and Malfunctions - Fixed static linking of OpenSSL 3.5+ on Windows. > #### Full runtime dependencies of crypto-5.5.3.1 > > erts-9.0, kernel-5.3, stdlib-3.9 # erts-15.2.7.6 The erts-15.2.7.6 application can be applied independently of other applications on a full OTP 27 installation. ## Fixed Bugs and Malfunctions - Fixed bug in `ets:update_counter/4` and `ets:update_element/4` accepting and inserting a default tuple smaller than the `keypos` of the table. Such a tuple without a key element would make the table internally inconsistent and might lead to bad behavior at table access, like ERTS runtime crash. - A missing memory barrier when unlocking process locks could cause unexpected behavior on architectures with weak memory ordering such as for example ARM. - A process could fail to wake from hibernation when a non‑message signal followed by a message signal arrived concurrently as the receiving process hibernated. If the process had a large heap, triggering a dirty GC, the wakeup could be lost. > #### Full runtime dependencies of erts-15.2.7.6 > > kernel-9.0, sasl-3.3, stdlib-4.1 # ssh-5.2.11.5 The ssh-5.2.11.5 application can be applied independently of other applications on a full OTP 27 installation. ## Fixed Bugs and Malfunctions - Fix handling of the SSH “each side may guess” key-exchange mechanism as defined in RFC 4253, Section 7. > #### Full runtime dependencies of ssh-5.2.11.5 > > crypto-5.0, erts-14.0, kernel-9.0, public\_key-1.6.1, runtime\_tools-1.15.1, > stdlib-5.0, stdlib-6.0 # stdlib-6.2.2.3 The stdlib-6.2.2.3 application can be applied independently of other applications on a full OTP 27 installation. ## Fixed Bugs and Malfunctions - Fixed bug in `ets:update_counter/4` and `ets:update_element/4` accepting and inserting a default tuple smaller than the `keypos` of the table. Such a tuple without a key element would make the table internally inconsistent and might lead to bad behavior at table access, like ERTS runtime crash. - For a function that started with a bracket-only pattern (such as `[]`), the `?FUNCTION_ARITY` macro would evaluate to one less than the actual arity. > #### Full runtime dependencies of stdlib-6.2.2.3 > > compiler-5.0, crypto-4.5, erts-15.0, kernel-10.0, sasl-3.0 # tftp-1.2.2.1 The tftp-1.2.2.1 application can be applied independently of other applications on a full OTP 27 installation. ## Fixed Bugs and Malfunctions - An issue in the undocumented initial state option [{root\_dir,Dir}] to the tftp\_file module has been fixed. The request file name was just concatenated to Dir so it was possible to traverse above Dir by using “../” file path components. Now the option actually restricts local file operations to the Dir directory and subdirectories. > #### Full runtime dependencies of tftp-1.2.2.1 > > erts-6.0, kernel-6.0, stdlib-5.0 # Thanks to Daniel Hryzbil, Jan Uhlig ---
**Author:** ![raimo](https://erlangforums.com/user_avatar/erlangforums.com/raimo/32/867_2.png) [@raimo](https://erlangforums.com/u/raimo)\ **Post date:** [February 20, 2026, 10:15am UTC](https://erlangforums.com/t/patch-package-otp-27-3-4-8-released/5447/3 "2026-02-20T10:15:32Z")