# Patch Package OTP 28.0.3 Released

**URL:** <https://erlangforums.com/t/patch-package-otp-28-0-3-released/5047>\
**Category:** Erlang News\
**Tags:** erlang-release\
**Created:** [September 10, 2025, 2:41pm UTC](https://erlangforums.com/t/patch-package-otp-28-0-3-released/5047 "2025-09-10T14:41:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kuba](https://erlangforums.com/user_avatar/erlangforums.com/kuba/32/194_2.png) [@kuba](https://erlangforums.com/u/kuba)\
**Post date:** [September 10, 2025, 2:41pm UTC](https://erlangforums.com/t/patch-package-otp-28-0-3-released/5047/1 "2025-09-10T14:41:28Z")

</div>

```erlang
Patch Package: OTP 28.0.3
Git Tag: OTP-28.0.3
Date: 2025-09-10
Trouble Report Id: OTP-19701, OTP-19741, OTP-19742, OTP-19748,
                         OTP-19753, OTP-19755, OTP-19761
Seq num: CVE-2025-48038, CVE-2025-48039,
                         CVE-2025-48040, CVE-2025-48041,
                         CVE-2025-58050, PR-10155, PR-10156, PR-10157,
                         PR-10162, PR-19755, PR-9815
System: OTP
Release: 28
Application: diameter-2.5.1, erts-16.0.3, ssh-5.3.3,
                         stdlib-7.0.3
Predecessor: OTP 28.0.2

```

Check out the git tag OTP-28.0.3, and build a full OTP system including  
documentation. Apply one or more applications from this build as patches to your  
installation using the ‘otp\_patch\_apply’ tool. For information on install  
requirements, see descriptions for each application version below.

# POTENTIAL INCOMPATIBILITIES

- Option max\_handles can be configured for sshd running SFTP. The positive  
integer value limits amount of file handles opened for a connection (by  
default 4096 is used).

- Avoid decoding KEX messages providing too many algorithms. This change does  
not introduce new limitation but assures it is enforced earlier in processing  
chain. Adjustments in error logging during handshake.

- A new ‘max\_path’ option is now available in the sshd configuration, allowing  
administrators to set the maximum allowable path length. By default, this  
value is set to 4096 characters.

- Reject file handles exceeding size specified in RFCs (256 bytes).

# diameter-2.5.1

The diameter-2.5.1 application can be applied independently of other  
applications on a full OTP 28 installation.

## Fixed Bugs and Malfunctions

- With this change message\_cb callback will be called with updated state for  
processing ‘ack’ after ‘send’.

> #### Full runtime dependencies of diameter-2.5.1
> 
> erts-10.0, kernel-3.2, ssl-9.0, stdlib-5.0

# erts-16.0.3

The erts-16.0.3 application can be applied independently of other applications  
on a full OTP 28 installation.

## Fixed Bugs and Malfunctions

- Update PCRE2 from 10.45 to 10.46. Fixes potential buffer read overflow on  
regular expressions with `(*scs:)` and `(*ACCEPT)` syntax combined.

- Fixed bug that could cause crash in beam started with  
`erl -emu_type debug +JPperf true` with any type of tracing return from  
function.

> #### Full runtime dependencies of erts-16.0.3
> 
> kernel-9.0, sasl-3.3, stdlib-4.1

# ssh-5.3.3

The ssh-5.3.3 application can be applied independently of other applications on  
a full OTP 28 installation.

## Fixed Bugs and Malfunctions

- Option max\_handles can be configured for sshd running SFTP. The positive  
integer value limits amount of file handles opened for a connection (by  
default 4096 is used).

- Avoid decoding KEX messages providing too many algorithms. This change does  
not introduce new limitation but assures it is enforced earlier in processing  
chain. Adjustments in error logging during handshake.

- A new ‘max\_path’ option is now available in the sshd configuration, allowing  
administrators to set the maximum allowable path length. By default, this  
value is set to 4096 characters.

- Reject file handles exceeding size specified in RFCs (256 bytes).

> #### Full runtime dependencies of ssh-5.3.3
> 
> crypto-5.0, erts-14.0, kernel-10.3, public\_key-1.6.1, runtime\_tools-1.15.1,  
> stdlib-5.0, stdlib-6.0

# stdlib-7.0.3

Note! The stdlib-7.0.3 application _cannot_ be applied independently of other  
applications on an arbitrary OTP 28 installation.

```
   On a full OTP 28 installation, also the following runtime
   dependency has to be satisfied:
   -- erts-16.0.3 (first satisfied in OTP 28.0.3)

```

## Fixed Bugs and Malfunctions

- Update PCRE2 from 10.45 to 10.46. Fixes potential buffer read overflow on  
regular expressions with `(*scs:)` and `(*ACCEPT)` syntax combined.

> #### Full runtime dependencies of stdlib-7.0.3
> 
> compiler-5.0, crypto-4.5, erts-16.0.3, kernel-10.0, sasl-3.0,  
> syntax\_tools-3.2.1

# Thanks to

Alberto Sartori

---

<div class="post-metadata">

**Author:** ![kuba](https://erlangforums.com/user_avatar/erlangforums.com/kuba/32/194_2.png) [@kuba](https://erlangforums.com/u/kuba)\
**Post date:** [September 10, 2025, 2:42pm UTC](https://erlangforums.com/t/patch-package-otp-28-0-3-released/5047/2 "2025-09-10T14:42:18Z")

</div>

Pinned globally on September 10, 2025, 2:42pm UTC



---

<div class="post-metadata">

**Author:** ![Led](https://erlangforums.com/user_avatar/erlangforums.com/led/32/1594_2.png) [@Led](https://erlangforums.com/u/Led)\
**Post date:** [September 11, 2025, 5:14am UTC](https://erlangforums.com/t/patch-package-otp-28-0-3-released/5047/3 "2025-09-11T05:14:20Z")

</div>

MD5.txt and SHA256.txt are missing.