# Patch Package OTP 28.5.0.4 Released **URL:** \ **Category:** Erlang News\ **Tags:** erlang-release\ **Created:** [July 27, 2026, 1:25pm UTC](https://erlangforums.com/t/patch-package-otp-28-5-0-4-released/5815 "2026-07-27T13:25:11Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![seal](https://erlangforums.com/user_avatar/erlangforums.com/seal/32/2346_2.png) [@seal](https://erlangforums.com/u/seal)\ **Post date:** [July 27, 2026, 1:25pm UTC](https://erlangforums.com/t/patch-package-otp-28-5-0-4-released/5815/1 "2026-07-27T13:25:11Z")
```erlang Patch Package: OTP 28.5.0.4 Git Tag: OTP-28.5.0.4 Date: 2026-07-27 Trouble Report Id: OTP-20136, OTP-20143, OTP-20214, OTP-20229, OTP-20237, OTP-20239, OTP-20240, OTP-20241, OTP-20242, OTP-20243, OTP-20244, OTP-20245, OTP-20248, OTP-20250, OTP-20251, OTP-20257, OTP-20258, OTP-20259, OTP-20260 Seq num: CVE-2026-42792, CVE-2026-47078, CVE-2026-54890, CVE-2026-55737, CVE-2026-55953, CVE-2026-58227, ERIERL-1341, GH-11319, GH-11332, GH-SA-622p-qfh6-c352, GH-SA-7xgh-gmgf-q2g7, PR-11239, PR-11297, PR-11303, PR-11323, PR-11330, PR-11331, PR-11333, PR-11334, PR-11336, PR-11337, PR-11341, PR-11343, PR-11369, PR-11372, PR-11386, PR-27944 System: OTP Release: 28 Application: crypto-5.8.3.2, diameter-2.6.1.2, erts-16.4.0.4, megaco-4.8.3.1, public_key-1.20.3.4, ssh-5.5.2.3, ssl-11.6.0.4, stdlib-7.3.0.1 Predecessor: OTP 28.5.0.3 ``` Check out the git tag OTP-28.5.0.4, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the ‘otp\_patch\_apply’ tool. For information on install requirements, see descriptions for each application version below. # POTENTIAL INCOMPATIBILITIES - Mitigated a denial of service attack in epmd. # crypto-5.8.3.2 The crypto-5.8.3.2 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - Fixed crash in `crypto:macN/5` when supplied `MacLength` was greater than length of what the underlying hash returned. - Fixed segfault in `crypto:aead_cipher_init_nif` when argument validation fails. - Fix cipher key buffer overread for `chacha20_poly1305`. > #### Full runtime dependencies of crypto-5.8.3.2 > > erts-9.0, kernel-6.0, stdlib-3.9 # diameter-2.6.1.2 The diameter-2.6.1.2 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - Fix infinite loop in `diameter_dist:route_session/2` when avp other than `Session-Id` has zero length. - Fix crash in `diameter_dist:route_session/2` when `Session-Id` (code: 263) avp has zero length. > #### Full runtime dependencies of diameter-2.6.1.2 > > erts-10.0, kernel-3.2, ssl-9.0, stdlib-5.0 # erts-16.4.0.4 The erts-16.4.0.4 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - Mitigated a denial of service attack in epmd. - Fixed heap corruption when an invalidly encoded tuple with an arity of 2^31 or larger is decoded from Erlang’s External Term Format (binary\_to\_term). - When send\_timeout is set and send\_timeout\_close is set to true, a ‘tcp\_closed’ message is expected when the timeout occurs, but that (message) was not delivered. This has now been fixed. - A crafted External Term Format (ETF) payload could crash the runtime system. - Fixed a rounding error in 16-bit float conversion. > #### Full runtime dependencies of erts-16.4.0.4 > > kernel-9.0, sasl-3.3, stdlib-4.1 # megaco-4.8.3.1 The megaco-4.8.3.1 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - Fixed a buffer overflow in the megaco flex scanner C driver. A property parm name exceeding 452 bytes in a text-encoded H.248 message could overflow a fixed-size error buffer, crashing the VM. The sprintf calls have been replaced with bounded snprintf. > #### Full runtime dependencies of megaco-4.8.3.1 > > asn1-3.0, debugger-4.0, erts-12.0, et-1.5, kernel-8.0, runtime\_tools-1.8.14, > stdlib-2.5 # public\_key-1.20.3.4 Note! The public\_key-1.20.3.4 application _cannot_ be applied independently of other applications on an arbitrary OTP 28 installation. ``` On a full OTP 28 installation, also the following runtime dependency has to be satisfied: -- crypto-5.8 (first satisfied in OTP 28.3) ``` ## Fixed Bugs and Malfunctions - A certificate chain with crafted policyMappings extensions could cause exponential memory consumption during path validation, exploitable via TLS handshake. Chains exceeding a node-count cap are now rejected with {bad\_cert, policy\_tree\_exceeded}. > #### Full runtime dependencies of public\_key-1.20.3.4 > > asn1-5.0, crypto-5.8, erts-13.0, kernel-8.0, stdlib-4.0 # ssh-5.5.2.3 Note! The ssh-5.5.2.3 application _cannot_ be applied independently of other applications on an arbitrary OTP 28 installation. ``` On a full OTP 28 installation, also the following runtime dependency has to be satisfied: -- crypto-5.7 (first satisfied in OTP 28.1) ``` ## Fixed Bugs and Malfunctions - DH key exchange now enforces strict bounds (1 \< e/f \< p-1, 1 \< K \< p-1) on all paths, matching OpenSSH and Go. No interop impact. - Validate DH group parameters (P, G) received from the server during DH-GEX key exchange. The client now rejects groups where P is smaller than 2048 bits or G is not in the range (1, P-1). The default minimum in dh\_gex\_limits has been raised to 2048 on both client and server. > #### Full runtime dependencies of ssh-5.5.2.3 > > crypto-5.7, erts-14.0, kernel-10.3, public\_key-1.6.1, runtime\_tools-1.15.1, > stdlib-5.0, stdlib-6.0 # ssl-11.6.0.4 Note! The ssl-11.6.0.4 application _cannot_ be applied independently of other applications on an arbitrary OTP 28 installation. ``` On a full OTP 28 installation, also the following runtime dependencies have to be satisfied: -- crypto-5.8 (first satisfied in OTP 28.3) -- public_key-1.20.3.1 (first satisfied in OTP 28.5.0.1) ``` ## Fixed Bugs and Malfunctions - Add pre TLS-1.3 client side validation of servers algorithm selection being part of clients offered algorithms, preventing in worst case MITM circumventing validation of server certificate tricking the client to trust the malicious MITM as it was a valid server. Note this check is already performed for TLS-1.3 clients. - Prevent invalid cert chains to create cycles in chain building code used to handle chains that could be unordered or contain extraneous certs. This avoids a DoS attack possibility. - Clarify that rsa\_psk and anonymous key exchange algorithms are considered legacy. Also harden rsa\_psk in same way as normal rsa key exchange. - Harden SSL application to conform with best practice and RFC’s. This will mostly improve error messages and conserve memory usage. - A certificate chain with crafted policyMappings extensions could cause exponential memory consumption during path validation, exploitable via TLS handshake. Chains exceeding a node-count cap are now rejected with {bad\_cert, policy\_tree\_exceeded}. > #### Full runtime dependencies of ssl-11.6.0.4 > > crypto-5.8, erts-16.0, inets-5.10.7, kernel-10.3, public\_key-1.20.3.1, > runtime\_tools-1.15.1, stdlib-7.0 # stdlib-7.3.0.1 Note! The stdlib-7.3.0.1 application _cannot_ be applied independently of other applications on an arbitrary OTP 28 installation. ``` On a full OTP 28 installation, also the following runtime dependency has to be satisfied: -- erts-16.0.3 (first satisfied in OTP 28.0.3) ``` ## Fixed Bugs and Malfunctions - Fixed a bug where zip:unzip/1,2 and zip:extract/1,2 were vulnerable to a relative path traversal attack. A crafted zip archive containing entry names such as ../x/y could have caused files to be written outside the intended extraction directory. > #### Full runtime dependencies of stdlib-7.3.0.1 > > compiler-5.0, crypto-4.5, erts-16.0.3, kernel-10.0, sasl-3.0, > syntax\_tools-3.2.1 # Thanks to a1x-an, Jonatan Männchen ---
**Author:** ![seal](https://erlangforums.com/user_avatar/erlangforums.com/seal/32/2346_2.png) [@seal](https://erlangforums.com/u/seal)\ **Post date:** [July 27, 2026, 1:25pm UTC](https://erlangforums.com/t/patch-package-otp-28-5-0-4-released/5815/3 "2026-07-27T13:25:24Z")