# Patch Package OTP 29.0.6 Released **URL:** \ **Category:** Erlang News\ **Tags:** erlang-release\ **Created:** [September 1, 2026, 12:07pm UTC](https://erlangforums.com/t/patch-package-otp-29-0-6-released/5911 "2026-09-01T12:07:44Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Whaileee](https://erlangforums.com/user_avatar/erlangforums.com/whaileee/32/3057_2.png) [@Whaileee](https://erlangforums.com/u/Whaileee)\ **Post date:** [September 1, 2026, 12:07pm UTC](https://erlangforums.com/t/patch-package-otp-29-0-6-released/5911/1 "2026-09-01T12:07:44Z")
```erlang Patch Package: OTP 29.0.6 Git Tag: OTP-29.0.6 Date: 2026-09-01 Trouble Report Id: OTP-20135, OTP-20234, OTP-20264, OTP-20268, OTP-20269, OTP-20270, OTP-20271, OTP-20274, OTP-20278, OTP-20279, OTP-20281, OTP-20282, OTP-20284, OTP-20286, OTP-20289, OTP-20296, OTP-20300, OTP-20301, OTP-20302, OTP-20306, OTP-20307, OTP-20308, OTP-20312, OTP-20319, OTP-20321, OTP-20324, OTP-20330, OTP-20333, OTP-20334, OTP-20342, OTP-20343, OTP-20344, OTP-20345, OTP-20346, OTP-20347, OTP-20350, OTP-20351 Seq num: CVE-2026-75538, ERIERL-1345, ERIERL-1354, GH-11052, GH-11240, GH-11278, GH-11380, GH-11404, GH-11416, GH-11419, GH-11494, GH-11511, PR-11298, PR-11325, PR-11358, PR-11417, PR-11425, PR-11428, PR-11429, PR-11437, PR-11463, PR-11464, PR-11470, PR-11478, PR-11481, PR-11485, PR-11492, PR-11503, PR-11509, PR-11513, PR-11517, PR-11521, PR-11533, PR-11538, PR-11539, PR-11540, PR-11541, PR-11542, PR-11543, PR-11544, PR-11545, PR-11546, PR-11547, PR-11548, PR-11553, PR-11554 System: OTP Release: 29 Application: compiler-10.0.4, crypto-5.9.3, eldap-1.3.1, erl_interface-5.8.2, erts-17.0.6, inets-9.7.2, megaco-4.9.2, mnesia-4.26.2, public_key-1.21.5, snmp-5.20.5, ssh-6.0.5, ssl-11.7.5, stdlib-8.0.4, tools-4.2.2 Predecessor: OTP 29.0.5 ``` Check out the git tag OTP-29.0.6, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the ‘otp\_patch\_apply’ tool. For information on install requirements, see descriptions for each application version below. # compiler-10.0.4 The compiler-10.0.4 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - compiler: Fix bug in `beam_types:subtract/2` for bitstrings > #### Full runtime dependencies of compiler-10.0.4 > > crypto-5.1, erts-13.0, kernel-8.4, stdlib-8.0 # crypto-5.9.3 The crypto-5.9.3 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - Fixed type mismatch between `ErlNifUInt64` and `uint64_t` in crypto NIF that caused incompatible-pointer warnings on macOS arm64 when passing DH parameters to OpenSSL. > #### Full runtime dependencies of crypto-5.9.3 > > erts-9.0, kernel-6.0, stdlib-3.9 # eldap-1.3.1 The eldap-1.3.1 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - eldap referral URL parsing now rejects a port component longer than 5 digits instead of attempting to convert an arbitrarily large digit string to an integer. > #### Full runtime dependencies of eldap-1.3.1 > > asn1-3.0, erts-6.0, kernel-3.0, ssl-5.3.4, stdlib-3.4 # erl\_interface-5.8.2 The erl\_interface-5.8.2 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - erl\_interface: Fix buffer leak and state corruption on `ei_x_buff` realloc failure # erts-17.0.6 The erts-17.0.6 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - No-suspend port command signals (i.e. port command signals sent using the `erlang:port_command/3` BIF or the `erlang:send/3` BIF with the `nosuspend` option) were not aborted properly in all scenarios which could leave the port queue in a busy state indefinitely. Also asynchronously sent no-suspend command signals (i.e, port command signals sent using the `erlang:send/3` BIF with the `nosuspend` option) could sometimes be delivered even though the port was busy. - erts: Fix missing exit\_status caused by SIGCHLD race - erts: Fix bug in `is_in_range` instruction for x86 JIT - Fixed bug in `binary_to_term` that could cause emulator crash for specific terms in specific process states (reductions left). - erts: Fix crash with `term_to_iovec/2` for large binary - A distributed `priority` send larger than 32 KiB to a process alias caused the receiving runtime system to crash. - Priority message queue markers were sometimes installed in the message queue even when no priority messages could be received. As a result, the two markers had to be traversed unnecessarily when scanning the message queue, introducing a small but avoidable overhead. - A monitor of `time_offset` co-created with a process alias (`monitor(time_offset, clock_service, [{alias, UnaliasOpt}])`) either crashed the runtime system or did not work. This bug was introduced in OTP 25.0. - A process alias was erroneously created when a remote `spawn_request()` operation with a `{monitor, [{alias, explicit_unalias}]}` option failed with `noconnection` reason. - A `gen_tcp` socket using the inet driver and `{packet,4}` had a bug if receiving a packet with size just below INT\_MAX. > #### Full runtime dependencies of erts-17.0.6 > > kernel-9.0, sasl-3.3, stdlib-4.1 # inets-9.7.2 The inets-9.7.2 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - The `dets` and `mnesia` `mod_auth` backends used a key that did not include the directory path, so all `require_user`/`require_group` records collapsed into one per-listener namespace. A user authorized for one protected directory could authenticate against any other protected directory served by the same listener. `{path, Directory}` is now included in the auth backend key, scoping records per directory as documented. - Requests specifying both `Transfer-Encoding` and `Content-Length` headers are now rejected with `400 Bad Request`, per RFC 9112 Section 6.3. Previously such requests could be used for CL.TE request-smuggling/desync attacks against reverse proxies in front of `httpd`. - `httpd` accepted the obsolete header line-folding syntax (RFC 9112 Section 5.2, a continuation line beginning with space/tab), silently treating the folded continuation as a separate header. This allowed CL.TE-style request smuggling when `httpd` was placed behind a folding-aware proxy. Such requests are now rejected with `400 Bad Request`. - A header such as `Content-Length : 6` (whitespace before the colon) was previously silently dropped, causing the content length to default to 0 and the body bytes to be misinterpreted as a pipelined request (CL.0 smuggling). Per RFC 7230 Section 3.2.4, such headers are now rejected with `400 Bad Request`. - A new httpd option `request_timeout` (default 60 seconds, renamed from the interim `max_body_read_timeout`) bounds the idle time between reads of a request body/message. The server now also sends `408 Request Timeout` when the `min_bytes_per_second` floor is hit, and `keep_alive_timeout` measurement was corrected so the timer is cancelled as soon as new data arrives rather than only after full header parsing; `keep_alive_timeout` and `request_timeout` now also accept `infinity` to disable the timeout. - `mod_auth`, `mod_security`, and `mod_get` compared resolved filesystem paths against configured protected-directory patterns without normalizing repeated slashes or filesystem case. On case-insensitive filesystems (macOS, Windows) or with repeated slashes, a request could resolve to a protected resource while evading the directory match. Paths are now canonicalized (slash-collapsed, and case-normalized when the filesystem is case-insensitive) before the authorization decision. - A request with an invalid chunked transfer-encoding chunk size previously caused the httpd connection handler to hang indefinitely without requiring further input from the client. This leaked a process per request and could be used to exhaust server resources (denial of service). Invalid chunk sizes are now rejected immediately with an error response, and the connection is closed. - `max_body_size` was previously enforced only after a complete chunk had been received, allowing a single oversized chunk to be buffered in full before the limit was checked — undermining the memory-exhaustion protection the option is meant to provide. The limit is now enforced incrementally as chunk data arrives, rejecting the request as soon as the configured size is exceeded. - The documented default of 150 for the `max_clients` option was not applied by the implementation, allowing an unbounded number of concurrent clients to connect regardless of configuration. The default is now correctly enforced. - Fixed a bug where httpd failed to start when configured with {socket\_type, {ip\_comm, SockOpts}} and a fixed (non-zero) port. - `httpc` now enforces a limit on the total size of response headers and response body, preventing unbounded memory allocation when connecting to a malicious or malfunctioning server. The new max\_header\_size and max\_body\_size request options can be used to override the default limit (10240 bytes for headers). Additionally, httpc now validates that the Content-Length header contains only digits before use, avoiding a crash on malformed responses. > #### Full runtime dependencies of inets-9.7.2 > > erts-14.0, kernel-9.0, mnesia-4.12, public\_key-1.13, runtime\_tools-1.8.14, ssl-9.0, stdlib-5.0, stdlib-6.0 # megaco-4.9.2 The megaco-4.9.2 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - Numeric fields in megaco text-encoded messages are now validated for digit-string length before integer conversion, improving robustness of the text decoder. Per-field digit limits based on the H.248.1 ASN.1 type constraints are enforced (e.g., 10 digits for UINT32, 2 digits for timer values), along with a 100 KB overall message size cap at the scanner entry point. The binary (BER/PER) codec is not affected. > #### Full runtime dependencies of megaco-4.9.2 > > asn1-3.0, debugger-4.0, erts-12.0, et-1.5, kernel-8.0, runtime\_tools-1.8.14, stdlib-2.5 # mnesia-4.26.2 The mnesia-4.26.2 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - A transaction iterating a table (first/1, last/1, next/2, prev/2, select, select\_reverse on non-ordered\_set) leaked a safe\_fixtable hold when the coordinator was killed by an external signal. The table remained fixed for the lifetime of the node, preventing space reclamation of deleted objects. - Fixed a race condition where mnesia\_controller could crash if a table was deleted while `mnesia:set_master_nodes/2` was being processed. > #### Full runtime dependencies of mnesia-4.26.2 > > erts-9.0, kernel-5.3, stdlib-5.0 # public\_key-1.21.5 The public\_key-1.21.5 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - Retain lost CommonName length relaxation. > #### Full runtime dependencies of public\_key-1.21.5 > > asn1-5.0, crypto-5.8, erts-13.0, kernel-8.0, stdlib-4.0 # snmp-5.20.5 The snmp-5.20.5 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - The SNMP PDU decoder now bounds the byte length accepted for INTEGER, Counter32, Gauge32/Unsigned32, TimeTicks, and Counter64 values during decoding (4, 5, 5, 5, and 9 bytes respectively, matching the SMIv2 value ranges), instead of accepting an arbitrarily large byte string and converting it to an integer. > #### Full runtime dependencies of snmp-5.20.5 > > asn1-5.4, crypto-4.6, erts-12.0, kernel-8.0, mnesia-4.12, runtime\_tools-1.8.14, stdlib-5.0 # ssh-6.0.5 The ssh-6.0.5 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - Fixed a bug where multiple subsystem requests could succeed on same ssh channel which is forbidden by RFC 4254 §6.5 > #### Full runtime dependencies of ssh-6.0.5 > > crypto-5.7, erts-14.0, kernel-10.3, public\_key-1.6.1, runtime\_tools-1.15.1, stdlib-8.0 # ssl-11.7.5 Note! The ssl-11.7.5 application _cannot_ be applied independently of other applications on an arbitrary OTP 29 installation. ```erlang On a full OTP 29 installation, also the following runtime dependency has to be satisfied: -- public_key-1.21.1 (first satisfied in OTP 29.0.1) ``` ## Fixed Bugs and Malfunctions - Debugging keylog\_hs callback used for logging handshake secrets on failed connections swapped the argument order in logging function confusing server and client side. The bug was introduced in OTP 28.5 ## Improvements and New Features - Hardening improvements of the ssl application. > #### Full runtime dependencies of ssl-11.7.5 > > crypto-5.8, erts-16.0, inets-5.10.7, kernel-10.3, public\_key-1.21.1, runtime\_tools-1.15.1, stdlib-7.0 # stdlib-8.0.4 The stdlib-8.0.4 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - Fixed a bug in `unicode_util:gc/1` where the grapheme cluster segmentation of `$\r` (not followed by `$\n`) would decompose binary continuations into mixed chardata. This caused `string:trim/3` (and `string:chomp/1`) to return incorrect results or crash when trimming strings containing binaries followed by another list element. - `record_info/2` will now mark tuple records as used. - `uri_string:parse/1` now rejects URIs with an unreasonably long port component (more than 5 digits) instead of attempting to convert an arbitrarily large digit string to an integer. > #### Full runtime dependencies of stdlib-8.0.4 > > compiler-5.0, crypto-4.5, erts-16.0.3, kernel-11.0, sasl-3.0, syntax\_tools-3.2.1 # tools-4.2.2 The tools-4.2.2 application can be applied independently of other applications on a full OTP 29 installation. ## Fixed Bugs and Malfunctions - tools: fixes tprof not stopping tracing > #### Full runtime dependencies of tools-4.2.2 > > compiler-8.5, crypto-5.9, erts-15.0, kernel-10.0, public\_key-1.21, runtime\_tools-2.1, stdlib-6.0 # Thanks to Andrew Bennett, ausimian, Laurynas Četyrkinas, ruslandoga, Thomas Cioppettini ---
**Author:** ![Whaileee](https://erlangforums.com/user_avatar/erlangforums.com/whaileee/32/3057_2.png) [@Whaileee](https://erlangforums.com/u/Whaileee)\ **Post date:** [September 1, 2026, 12:08pm UTC](https://erlangforums.com/t/patch-package-otp-29-0-6-released/5911/3 "2026-09-01T12:08:18Z")
---
**Author:** ![danj](https://erlangforums.com/letter_avatar_proxy/v4/letter/d/db5fbb/32.png) [@danj](https://erlangforums.com/u/danj)\ **Post date:** [September 2, 2026, 3:24am UTC](https://erlangforums.com/t/patch-package-otp-29-0-6-released/5911/4 "2026-09-02T03:24:10Z")
The EEF/CNA has prepared a debrief of these changes. > **[OTP updates address http and integer vulnerabilities](https://com.erlef.org/wg/cna/2026/09/01/otp-updates.html)** > > Remedies for http client and server bugs, integer serialization DoS