# Patch Package OTP 29.0.2 Released **URL:** \ **Category:** Erlang News\ **Tags:** erlang-release\ **Created:** [June 10, 2026, 10:14am UTC](https://erlangforums.com/t/patch-package-otp-29-0-2-released/5705 "2026-06-10T10:14:44Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Whaileee](https://erlangforums.com/user_avatar/erlangforums.com/whaileee/32/3057_2.png) [@Whaileee](https://erlangforums.com/u/Whaileee)\ **Post date:** [June 10, 2026, 10:14am UTC](https://erlangforums.com/t/patch-package-otp-29-0-2-released/5705/1 "2026-06-10T10:14:44Z")
```erlang Patch Package: OTP 29.0.2 Git Tag: OTP-29.0.2 Date: 2026-06-10 Trouble Report Id: OTP-20057, OTP-20149, OTP-20150, OTP-20151, OTP-20153, OTP-20154, OTP-20155, OTP-20156, OTP-20160, OTP-20161, OTP-20162, OTP-20163, OTP-20165, OTP-20166, OTP-20170, OTP-20172, OTP-20174, OTP-20178, OTP-20181 Seq num: CVE-2026-48855, CVE-2026-48856, CVE-2026-48858, CVE-2026-48859, CVE-2026-48860, CVE-2026-49759, CVE-2026-49760, GH-11104, GH-11105, GH-11152, GH-SA-24cv-hwgr-37fq, GH-SA-3w6p-vwhf-wvp4, GH-SA-6f4f-chj5-5g97, GH-SA-gp7x-mfv6-52cv, GH-SA-m75x-4vwg-ggjh, GH-SA-pv7g-pjrq-x2fh, GH-SA-xcxj-5pg2-v72j, PR-11141, PR-11145, PR-11146, PR-11148, PR-11154, PR-11157, PR-11168, PR-11181, PR-11186, PR-11192, PR-11193, PR-11195, PR-11199, PR-11205, PR-11212, PR-1234, PR-27384 System: OTP Release: 29 Application: dialyzer-6.0.1, diameter-2.7.1, erl_interface-5.8.1, erts-17.0.2, ftp-1.2.6, inets-9.7.1, kernel-11.0.2, mnesia-4.26.1, public_key-1.21.2, ssh-6.0.1, ssl-11.7.2, stdlib-8.0.1, tools-4.2.1 Predecessor: OTP 29.0.1 ``` Check out the git tag OTP-29.0.2, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the ‘otp\_patch\_apply’ tool. For information on install requirements, see descriptions for each application version below. # dialyzer-6.0.1 The dialyzer-6.0.1 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - Fix native record bugs in Dialyzer > #### Full runtime dependencies of dialyzer-6.0.1 > > compiler-10.0, erts-12.0, kernel-8.0, stdlib-5.0, syntax\_tools-2.0 # diameter-2.7.1 The diameter-2.7.1 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - Fixed return value documentation of `diameter:service_info(SvcName, statistics)` > #### Full runtime dependencies of diameter-2.7.1 > > erts-10.0, kernel-3.2, ssl-9.0, stdlib-5.0 # erl\_interface-5.8.1 The erl\_interface-5.8.1 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - Fixed stack overflow in `ei_s_print_term` for very big integer terms (\> 2000 hexadecimal digits long). # erts-17.0.2 The erts-17.0.2 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - A buffer overflow error when parsing SCTP ERROR or ABORT chunks has been fixed. > #### Full runtime dependencies of erts-17.0.2 > > kernel-9.0, sasl-3.3, stdlib-4.1 # ftp-1.2.6 The ftp-1.2.6 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - FTP client default connections that use the so called passive mode of FTP fails to properly validating the response IP of the server, hence a malicious or compromised FTP server could redirect the data connection to an arbitrary host, enabling s server-side request forgery (SSRF) and FTP bounce attacks. > #### Full runtime dependencies of ftp-1.2.6 > > erts-7.0, kernel-6.0, runtime\_tools-1.15.1, ssl-10.2, stdlib-3.5 # inets-9.7.1 The inets-9.7.1 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - The HTTP client (httpc) now removes Authorization, Proxy-Authorization, Cookie, Referer, and Origin headers when following a redirect to a different host or port. Previously these headers were forwarded verbatim, potentially leaking credentials to unintended targets. > #### Full runtime dependencies of inets-9.7.1 > > erts-14.0, kernel-9.0, mnesia-4.12, public\_key-1.13, runtime\_tools-1.8.14, > ssl-9.0, stdlib-5.0, stdlib-6.0 # kernel-11.0.2 The kernel-11.0.2 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - gen\_tcp\_socket accept should explicitly inherit the same options as plain gen\_tcp. > #### Full runtime dependencies of kernel-11.0.2 > > crypto-5.8, erts-17.0, sasl-3.0, stdlib-8.0 # mnesia-4.26.1 The mnesia-4.26.1 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - Fixed docs of `mnesia:write/3` to clarify when a transaction can terminate. > #### Full runtime dependencies of mnesia-4.26.1 > > erts-9.0, kernel-5.3, stdlib-5.0 # public\_key-1.21.2 The public\_key-1.21.2 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - Add missing macro reference for legacy algorithms md5 and sha224. This mainly improves error handling. > #### Full runtime dependencies of public\_key-1.21.2 > > asn1-5.0, crypto-5.8, erts-13.0, kernel-8.0, stdlib-4.0 # ssh-6.0.1 The ssh-6.0.1 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - Fixed a timing-based username enumeration vulnerability during password authentication with the user\_passwords option. A dummy PBKDF2 computation is now performed for invalid usernames to match the response time of valid ones. - Fixed SSH\_FXP\_READLINK handler in ssh\_sftpd to strip the backend root prefix from symlink targets before returning them to the client, preventing disclosure of the server’s absolute filesystem path when the root option is configured. - Fixed a race condition where SSH keep-alive responses could consume pending channel open requests, causing channel setup to fail silently. > #### Full runtime dependencies of ssh-6.0.1 > > crypto-5.7, erts-14.0, kernel-10.3, public\_key-1.6.1, runtime\_tools-1.15.1, > stdlib-8.0 # ssl-11.7.2 Note! The ssl-11.7.2 application _cannot_ be applied independently of other applications on an arbitrary OTP 29 installation. ```erlang On a full OTP 29 installation, also the following runtime dependency has to be satisfied: -- public_key-1.21.1 (first satisfied in OTP 29.0.1) ``` ## Fixed Bugs and Malfunctions - Fix miscellanies issues that could cause unnecessary memory consumption and in some less common scenarios or configurations cause connection failures. - Erlang distribution over TLS run with the kernel ‘check\_ip’ flag now properly enforce connecting nodes to be on the same LAN. - Enhance error message, by fixing typo of atom in new error message related to `public_key` CVE-2026-42790 solution. - Corrected SNI handling for TLS-1.3 only server, could cause connection failures if supported signature algorithms where changed by SNI option update. > #### Full runtime dependencies of ssl-11.7.2 > > crypto-5.8, erts-16.0, inets-5.10.7, kernel-10.3, public\_key-1.21.1, > runtime\_tools-1.15.1, stdlib-7.0 # stdlib-8.0.1 The stdlib-8.0.1 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - Fix a bug where a tuple record operation within a native record anonymous update can crash. - Fixed some bugs in `io_lib:bformat/2` and native record printing. > #### Full runtime dependencies of stdlib-8.0.1 > > compiler-5.0, crypto-4.5, erts-16.0.3, kernel-11.0, sasl-3.0, > syntax\_tools-3.2.1 # tools-4.2.1 The tools-4.2.1 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - Xref could crash instead of returning an appropriate error tuple when asked to open a BEAM file without debug information but with a `moduledoc(false)` attribute. > #### Full runtime dependencies of tools-4.2.1 > > compiler-8.5, crypto-5.9, erts-15.0, kernel-10.0, public\_key-1.21, > runtime\_tools-2.1, stdlib-6.0 # Thanks to John Downey, Jonatan Männchen ---
**Author:** ![Whaileee](https://erlangforums.com/user_avatar/erlangforums.com/whaileee/32/3057_2.png) [@Whaileee](https://erlangforums.com/u/Whaileee)\ **Post date:** [June 10, 2026, 10:15am UTC](https://erlangforums.com/t/patch-package-otp-29-0-2-released/5705/3 "2026-06-10T10:15:33Z")