# Patch Package OTP 28.5.0.2 Released **URL:** \ **Category:** Erlang News\ **Tags:** erlang-release\ **Created:** [June 10, 2026, 12:19pm UTC](https://erlangforums.com/t/patch-package-otp-28-5-0-2-released/5708 "2026-06-10T12:19:57Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Whaileee](https://erlangforums.com/user_avatar/erlangforums.com/whaileee/32/3057_2.png) [@Whaileee](https://erlangforums.com/u/Whaileee)\ **Post date:** [June 10, 2026, 12:19pm UTC](https://erlangforums.com/t/patch-package-otp-28-5-0-2-released/5708/1 "2026-06-10T12:19:57Z")
```erlang Patch Package: OTP 28.5.0.2 Git Tag: OTP-28.5.0.2 Date: 2026-06-10 Trouble Report Id: OTP-19631, OTP-20057, OTP-20149, OTP-20150, OTP-20152, OTP-20154, OTP-20155, OTP-20156, OTP-20160, OTP-20161, OTP-20162, OTP-20165, OTP-20166, OTP-20172, OTP-20174 Seq num: CVE-2026-48855, CVE-2026-48856, CVE-2026-48858, CVE-2026-48860, CVE-2026-49759, CVE-2026-49760, GH-11093, GH-11104, GH-11105, GH-SA-24cv-hwgr-37fq, GH-SA-6f4f-chj5-5g97, GH-SA-gp7x-mfv6-52cv, GH-SA-m75x-4vwg-ggjh, GH-SA-pv7g-pjrq-x2fh, GH-SA-xcxj-5pg2-v72j, PR-11096, PR-11115, PR-11145, PR-11146, PR-11148, PR-11181, PR-11186, PR-11192, PR-11193, PR-11195, PR-11212, PR-1234, PR-27384 System: OTP Release: 28 Application: dialyzer-5.4.0.1, diameter-2.6.1.1, erl_interface-5.7.0.1, erts-16.4.0.2, ftp-1.2.4.1, inets-9.6.2.2, kernel-10.6.3.2, mnesia-4.25.3.1, public_key-1.20.3.2, ssh-5.5.2.1, ssl-11.6.0.2 Predecessor: OTP 28.5.0.1 ``` Check out the git tag OTP-28.5.0.2, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the ‘otp\_patch\_apply’ tool. For information on install requirements, see descriptions for each application version below. # dialyzer-5.4.0.1 The dialyzer-5.4.0.1 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - Fix Dialyzer crash with overriding built-in types > #### Full runtime dependencies of dialyzer-5.4.0.1 > > compiler-8.0, erts-12.0, kernel-8.0, stdlib-5.0, syntax\_tools-2.0 # diameter-2.6.1.1 The diameter-2.6.1.1 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - Fixed return value documentation of `diameter:service_info(SvcName, statistics)` > #### Full runtime dependencies of diameter-2.6.1.1 > > erts-10.0, kernel-3.2, ssl-9.0, stdlib-5.0 # erl\_interface-5.7.0.1 The erl\_interface-5.7.0.1 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - Fixed stack overflow in `ei_s_print_term` for very big integer terms (\> 2000 hexadecimal digits long). # erts-16.4.0.2 The erts-16.4.0.2 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - Fixed bug in `ets:member/2` for `set`, `bag` and `duplicate_bag`. The bug could (maybe) lead to `ets:member` spuriously returning false for a value which is actually a member for a table that faces high insert load. - A buffer overflow error when parsing SCTP ERROR or ABORT chunks has been fixed. > #### Full runtime dependencies of erts-16.4.0.2 > > kernel-9.0, sasl-3.3, stdlib-4.1 # ftp-1.2.4.1 The ftp-1.2.4.1 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - FTP client default connections that use the so called passive mode of FTP fails to properly validating the response IP of the server, hence a malicious or compromised FTP server could redirect the data connection to an arbitrary host, enabling s server-side request forgery (SSRF) and FTP bounce attacks. > #### Full runtime dependencies of ftp-1.2.4.1 > > erts-7.0, kernel-6.0, runtime\_tools-1.15.1, ssl-10.2, stdlib-3.5 # inets-9.6.2.2 The inets-9.6.2.2 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - The HTTP client (httpc) now removes Authorization, Proxy-Authorization, Cookie, Referer, and Origin headers when following a redirect to a different host or port. Previously these headers were forwarded verbatim, potentially leaking credentials to unintended targets. > #### Full runtime dependencies of inets-9.6.2.2 > > erts-14.0, kernel-9.0, mnesia-4.12, public\_key-1.13, runtime\_tools-1.8.14, > ssl-9.0, stdlib-5.0, stdlib-6.0 # kernel-10.6.3.2 The kernel-10.6.3.2 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - gen\_tcp\_socket accept should explicitly inherit the same options as plain gen\_tcp. > #### Full runtime dependencies of kernel-10.6.3.2 > > crypto-5.0, erts-15.2.5, sasl-3.0, stdlib-7.0 # mnesia-4.25.3.1 The mnesia-4.25.3.1 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - Fixed docs of `mnesia:write/3` to clarify when a transaction can terminate. > #### Full runtime dependencies of mnesia-4.25.3.1 > > erts-9.0, kernel-5.3, stdlib-5.0 # public\_key-1.20.3.2 Note! The public\_key-1.20.3.2 application _cannot_ be applied independently of other applications on an arbitrary OTP 28 installation. ``` On a full OTP 28 installation, also the following runtime dependency has to be satisfied: -- crypto-5.8 (first satisfied in OTP 28.3) ``` ## Fixed Bugs and Malfunctions - Add missing macro reference for legacy algorithms md5 and sha224. This mainly improves error handling. > #### Full runtime dependencies of public\_key-1.20.3.2 > > asn1-5.0, crypto-5.8, erts-13.0, kernel-8.0, stdlib-4.0 # ssh-5.5.2.1 Note! The ssh-5.5.2.1 application _cannot_ be applied independently of other applications on an arbitrary OTP 28 installation. ``` On a full OTP 28 installation, also the following runtime dependency has to be satisfied: -- crypto-5.7 (first satisfied in OTP 28.1) ``` ## Fixed Bugs and Malfunctions - Fixed SSH\_FXP\_READLINK handler in ssh\_sftpd to strip the backend root prefix from symlink targets before returning them to the client, preventing disclosure of the server’s absolute filesystem path when the root option is configured. > #### Full runtime dependencies of ssh-5.5.2.1 > > crypto-5.7, erts-14.0, kernel-10.3, public\_key-1.6.1, runtime\_tools-1.15.1, > stdlib-5.0, stdlib-6.0 # ssl-11.6.0.2 Note! The ssl-11.6.0.2 application _cannot_ be applied independently of other applications on an arbitrary OTP 28 installation. ``` On a full OTP 28 installation, also the following runtime dependencies have to be satisfied: -- crypto-5.8 (first satisfied in OTP 28.3) -- public_key-1.20.3.1 (first satisfied in OTP 28.5.0.1) ``` ## Fixed Bugs and Malfunctions - Fix miscellanies issues that could cause unnecessary memory consumption and in some less common scenarios or configurations cause connection failures. - Erlang distribution over TLS run with the kernel ‘check\_ip’ flag now properly enforce connecting nodes to be on the same LAN. - Enhance error message, by fixing typo of atom in new error message related to `public_key` CVE-2026-42790 solution. - Corrected SNI handling for TLS-1.3 only server, could cause connection failures if supported signature algorithms where changed by SNI option update. > #### Full runtime dependencies of ssl-11.6.0.2 > > crypto-5.8, erts-16.0, inets-5.10.7, kernel-10.3, public\_key-1.20.3.1, > runtime\_tools-1.15.1, stdlib-7.0 # Thanks to John Downey, Jonatan Männchen, Maria Scott ---
**Author:** ![Whaileee](https://erlangforums.com/user_avatar/erlangforums.com/whaileee/32/3057_2.png) [@Whaileee](https://erlangforums.com/u/Whaileee)\ **Post date:** [June 10, 2026, 12:20pm UTC](https://erlangforums.com/t/patch-package-otp-28-5-0-2-released/5708/2 "2026-06-10T12:20:07Z")