Patch Package: OTP 29.1.2
Git Tag: OTP-29.1.2
Date: 2026-10-14
Trouble Report Id: OTP-20359, OTP-20360, OTP-20385, OTP-20392,
OTP-20394, OTP-20408, OTP-20415, OTP-20418,
OTP-20420, OTP-20423, OTP-20426, OTP-20427,
OTP-20428, OTP-20437, OTP-20438, OTP-20439,
OTP-20440, OTP-20442, OTP-20444, OTP-20445,
OTP-20447, OTP-20456
Seq num: CVE-2026-105236, CVE-2026-42789,
CVE-2026-48856, CVE-2026-94200,
CVE-2026-96596, ERIERL-1362, ERIERL-1367,
GH-11620, GH-11691, GH-11702, GH-11709,
GH-11724, GH-11735, GH-11748, GH-11762,
GH-SA-m75x-4vwg-ggjh, GH-SA-q7cq-pfgf-5hr7,
OTP-20155, OTP-20346, PR-11474, PR-11561,
PR-11623, PR-11662, PR-11692, PR-11707,
PR-11708, PR-11719, PR-11720, PR-11727,
PR-11753, PR-11755, PR-11763, PR-11767,
PR-11768, PR-11773, PR-11791, PR-11808,
PR-11823, PR-11824, PR-11825
System: OTP
Release: 29
Application: compiler-10.0.7, dialyzer-6.0.4, erts-17.1.1,
inets-9.8.1, mnesia-4.27.1, odbc-2.17.2,
public_key-1.21.8, snmp-5.20.6, ssh-6.0.7,
ssl-11.7.8, stdlib-8.1.1
Predecessor: OTP 29.1.1
<p>Check out the git tag OTP-29.1.2, and build a full OTP system including<br>
documentation. Apply one or more applications from this build as patches to your<br>
installation using the ‘otp_patch_apply’ tool. For information on install<br>
requirements, see descriptions for each application version below.</p>
<h1><a name="p-23976-potential-incompatibilities-1" class="anchor" href="#p-23976-potential-incompatibilities-1" aria-label="Heading link"></a>POTENTIAL INCOMPATIBILITIES</h1>
<ul>
<li>
<p>When the max_channels limit is reached for a port-forwarding channel<br>
(direct-tcpip or forwarded-tcpip), the SSH daemon now refuses the individual<br>
channel with SSH_MSG_CHANNEL_OPEN_FAILURE and keeps the connection alive,<br>
instead of terminating the whole SSH connection. Port-forwarding channels now<br>
behave like session channels, which already survived the limit, and this<br>
matches OpenSSH. Applications that relied on the connection being closed when<br>
the channel limit was reached must instead handle the channel-open failure.</p>
<p>Own Id: OTP-20420<br>
Application(s): ssh<br>
Related Id(s): <a href="https://github.com/erlang/otp/pull/11708">PR-11708</a></p>
</li>
</ul>
<h1><a name="p-23976-compiler-1007-2" class="anchor" href="#p-23976-compiler-1007-2" aria-label="Heading link"></a>compiler-10.0.7</h1>
<p>The compiler-10.0.7 application can be applied independently of other<br>
applications on a full OTP 29 installation.</p>
<h2><a name="p-23976-fixed-bugs-and-malfunctions-3" class="anchor" href="#p-23976-fixed-bugs-and-malfunctions-3" aria-label="Heading link"></a>Fixed Bugs and Malfunctions</h2>
<ul>
<li>
<p>Fix native record bugs when used together with <code>try...catch</code></p>
<p>Own Id: OTP-20415<br>
Related Id(s): <a href="https://github.com/erlang/otp/issues/11691">GH-11691</a>, <a href="https://github.com/erlang/otp/pull/11719">PR-11719</a></p>
</li>
<li>
<p>Compilation of a function with thousands of clauses would be very slow.</p>
<p>Own Id: OTP-20437<br>
Related Id(s): <a href="https://github.com/erlang/otp/issues/11735">GH-11735</a>, <a href="https://github.com/erlang/otp/pull/11767">PR-11767</a></p>
</li>
<li>
<p>Sometimes compiling with <code>deterministic</code> would not guarantee generation of<br>
identical BEAM files for every build.</p>
<p>Own Id: OTP-20438<br>
Related Id(s): <a href="https://github.com/erlang/otp/issues/11748">GH-11748</a>, <a href="https://github.com/erlang/otp/pull/11753">PR-11753</a></p>
</li>
<li>
<p>A crash in <code>sys_core_fold</code> on native record patterns has been eliminated.</p>
<p>Own Id: OTP-20440<br>
Related Id(s): <a href="https://github.com/erlang/otp/issues/11724">GH-11724</a>, <a href="https://github.com/erlang/otp/pull/11768">PR-11768</a></p>
</li>
</ul>
<blockquote>
<h4>Full runtime dependencies of compiler-10.0.7</h4>
<p>crypto-5.1, erts-13.0, kernel-8.4, stdlib-8.0</p>
</blockquote>
<h1><a name="p-23976-dialyzer-604-4" class="anchor" href="#p-23976-dialyzer-604-4" aria-label="Heading link"></a>dialyzer-6.0.4</h1>
<p>The dialyzer-6.0.4 application can be applied independently of other<br>
applications on a full OTP 29 installation.</p>
<h2><a name="p-23976-fixed-bugs-and-malfunctions-5" class="anchor" href="#p-23976-fixed-bugs-and-malfunctions-5" aria-label="Heading link"></a>Fixed Bugs and Malfunctions</h2>
<ul>
<li>
<p>Dialyzer will now avoid an infinite loop when multiple nominal types with the<br>
same structure are analyzed together.</p>
<p>Own Id: OTP-20444<br>
Related Id(s): <a href="https://github.com/erlang/otp/issues/11762">GH-11762</a>, <a href="https://github.com/erlang/otp/pull/11763">PR-11763</a></p>
</li>
</ul>
<blockquote>
<h4>Full runtime dependencies of dialyzer-6.0.4</h4>
<p>compiler-10.0, erts-12.0, kernel-8.0, stdlib-5.0, syntax_tools-2.0</p>
</blockquote>
<h1><a name="p-23976-erts-1711-6" class="anchor" href="#p-23976-erts-1711-6" aria-label="Heading link"></a>erts-17.1.1</h1>
<p>The erts-17.1.1 application can be applied independently of other applications<br>
on a full OTP 29 installation.</p>
<h2><a name="p-23976-fixed-bugs-and-malfunctions-7" class="anchor" href="#p-23976-fixed-bugs-and-malfunctions-7" aria-label="Heading link"></a>Fixed Bugs and Malfunctions</h2>
<ul>
<li>
<p>Two trace sessions that trace <code>garbage_collection</code> on the same process crash<br>
the emulator on the first collection.</p>
<p><code>trace_gc()</code> in <code>erl_trace.c</code> builds the GC info list on a temporary heap for<br>
the first session and frees it inside the session loop. The next session<br>
reuses <code>msg</code>, which now points into freed memory.</p>
<p>The memory is now freed after the session loop, which removes the<br>
use-after-free.</p>
<p>Own Id: OTP-20385<br>
Related Id(s): <a href="https://github.com/erlang/otp/pull/11623">PR-11623</a></p>
</li>
<li>
<p>Fix native record bugs when used together with <code>try...catch</code></p>
<p>Own Id: OTP-20415<br>
Related Id(s): <a href="https://github.com/erlang/otp/issues/11691">GH-11691</a>, <a href="https://github.com/erlang/otp/pull/11719">PR-11719</a></p>
</li>
</ul>
<blockquote>
<h4>Full runtime dependencies of erts-17.1.1</h4>
<p>kernel-9.0, sasl-3.3, stdlib-4.1</p>
</blockquote>
<h1><a name="p-23976-inets-981-8" class="anchor" href="#p-23976-inets-981-8" aria-label="Heading link"></a>inets-9.8.1</h1>
<p>The inets-9.8.1 application can be applied independently of other applications<br>
on a full OTP 29 installation.</p>
<h2><a name="p-23976-fixed-bugs-and-malfunctions-9" class="anchor" href="#p-23976-fixed-bugs-and-malfunctions-9" aria-label="Heading link"></a>Fixed Bugs and Malfunctions</h2>
<ul>
<li>
<p>Credentials supplied in the userinfo component of a request URI<br>
(<code>http://user``:password@host/path</code>) were still sent to the redirect target when<br>
<code>httpc</code> followed a cross-origin redirect. The userinfo component is now<br>
cleared together with the sensitive headers whenever the redirect target<br>
differs in host or port from the original request. Redirects that stay within<br>
the same origin are unaffected and still carry the credentials.</p>
<p>Own Id: OTP-20456<br>
Related Id(s): <a href="https://github.com/erlang/otp/issues/SA-m75x-4vwg-ggjh">GH-SA-m75x-4vwg-ggjh</a>, <a href="https://github.com/erlang/otp/pull/11825">PR-11825</a>, <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-48856">CVE-2026-48856</a>, OTP-20155</p>
</li>
</ul>
<blockquote>
<h4>Full runtime dependencies of inets-9.8.1</h4>
<p>erts-14.0, kernel-9.0, mnesia-4.12, public_key-1.13, runtime_tools-1.8.14,<br>
ssl-9.0, stdlib-5.0, stdlib-6.0</p>
</blockquote>
<h1><a name="p-23976-mnesia-4271-10" class="anchor" href="#p-23976-mnesia-4271-10" aria-label="Heading link"></a>mnesia-4.27.1</h1>
<p>The mnesia-4.27.1 application can be applied independently of other applications<br>
on a full OTP 29 installation.</p>
<h2><a name="p-23976-fixed-bugs-and-malfunctions-11" class="anchor" href="#p-23976-fixed-bugs-and-malfunctions-11" aria-label="Heading link"></a>Fixed Bugs and Malfunctions</h2>
<ul>
<li>
<p>Fixed the type specification for <code>mnesia:restore/2</code>, which incorrectly listed<br>
the operation <code>restore_tables</code> instead of <code>recreate_tables</code>, causing Dialyzer<br>
to reject valid calls and accept invalid ones.</p>
<p>Own Id: OTP-20442<br>
Related Id(s): <a href="https://github.com/erlang/otp/pull/11755">PR-11755</a></p>
</li>
</ul>
<blockquote>
<h4>Full runtime dependencies of mnesia-4.27.1</h4>
<p>erts-9.0, kernel-5.3, stdlib-5.0</p>
</blockquote>
<h1><a name="p-23976-odbc-2172-12" class="anchor" href="#p-23976-odbc-2172-12" aria-label="Heading link"></a>odbc-2.17.2</h1>
<p>The odbc-2.17.2 application can be applied independently of other applications<br>
on a full OTP 29 installation.</p>
<h2><a name="p-23976-fixed-bugs-and-malfunctions-13" class="anchor" href="#p-23976-fixed-bugs-and-malfunctions-13" aria-label="Heading link"></a>Fixed Bugs and Malfunctions</h2>
<ul>
<li>
<p>Fix error handling to avoid possible memory issues that could cause odbc port<br>
program to fail.</p>
<p>Own Id: OTP-20439<br>
Related Id(s): <a href="https://github.com/erlang/otp/pull/11808">PR-11808</a></p>
</li>
</ul>
<blockquote>
<h4>Full runtime dependencies of odbc-2.17.2</h4>
<p>erts-6.0, kernel-3.0, stdlib-2.0</p>
</blockquote>
<h1><a name="p-23976-public_key-1218-14" class="anchor" href="#p-23976-public_key-1218-14" aria-label="Heading link"></a>public_key-1.21.8</h1>
<p>The public_key-1.21.8 application can be applied independently of other<br>
applications on a full OTP 29 installation.</p>
<h2><a name="p-23976-fixed-bugs-and-malfunctions-15" class="anchor" href="#p-23976-fixed-bugs-and-malfunctions-15" aria-label="Heading link"></a>Fixed Bugs and Malfunctions</h2>
<ul>
<li>
<p>Enforce the RFC 5280 basic-constraints CA checks for X.509 version 1 and<br>
version 2 certificates during certificate path validation. A v1/v2 certificate<br>
carries no extensions and therefore no basicConstraints, so it must never be<br>
accepted as a CA; such a certificate is now rejected in issuer position with<br>
{bad_cert, missing_basic_constraint} while remaining valid as a leaf. This<br>
closes the version-1 path left uncovered by the earlier CVE-2026-42789 fix.</p>
<p>Own Id: OTP-20423<br>
Related Id(s): <a href="https://github.com/erlang/otp/pull/11727">PR-11727</a>, <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42789">CVE-2026-42789</a></p>
</li>
</ul>
<blockquote>
<h4>Full runtime dependencies of public_key-1.21.8</h4>
<p>asn1-5.0, crypto-5.8, erts-13.0, kernel-8.0, stdlib-4.0</p>
</blockquote>
<h1><a name="p-23976-snmp-5206-16" class="anchor" href="#p-23976-snmp-5206-16" aria-label="Heading link"></a>snmp-5.20.6</h1>
<p>The snmp-5.20.6 application can be applied independently of other applications<br>
on a full OTP 29 installation.</p>
<h2><a name="p-23976-fixed-bugs-and-malfunctions-17" class="anchor" href="#p-23976-fixed-bugs-and-malfunctions-17" aria-label="Heading link"></a>Fixed Bugs and Malfunctions</h2>
<ul>
<li>
<p>The SNMP agent no longer fails to answer an SNMPv3 message whose msgUserName<br>
matches the configured terminating-discovery trigger_username (by default the<br>
empty string) and whose msgAuthoritativeEngineID is the agent’s own engine ID.<br>
Such a message is not a stage-1 discovery request, but the agent treated it as<br>
one and then failed while generating the report, logging a configuration error<br>
and discarding the request without responding. The agent now answers it with a<br>
usmStatsUnknownUserNames report, as prescribed by RFC 3414, section 3.2. As a<br>
consequence of the same change, a message carrying the trigger user name<br>
together with an unknown, non-empty engine ID is now answered with a<br>
usmStatsUnknownEngineIDs report instead of being silently discarded.</p>
<p>Own Id: OTP-20427<br>
Related Id(s): ERIERL-1362, <a href="https://github.com/erlang/otp/pull/11823">PR-11823</a></p>
</li>
<li>
<p>The byte-length bounds added in OTP-20346 for varbind values now apply to<br>
every integer field decoded by snmp_pdus: the v3 header fields msgID,<br>
msgMaxSize and msgSecurityModel, the USM security parameters<br>
msgAuthoritativeEngineBoots and msgAuthoritativeEngineTime, and the PDU fields<br>
request-id, error-status, error-index, non-repeaters, max-repetitions,<br>
generic-trap and specific-trap. Each field accepts at most the number of BER<br>
content octets that its type requires, instead of an arbitrary number of<br>
octets that were converted into a large integer. An over-long integer is now<br>
signalled with an exit rather than a throw. Code that calls the exported<br>
snmp_pdus decode functions inside a catch will receive {‘EXIT’, Reason} where<br>
it previously received the thrown term directly. Inside the agent and manager,<br>
such a message is now discarded and counted in snmpInASNParseErrs; previously<br>
it caused a case_clause failure during message processing.</p>
<p>Own Id: OTP-20428<br>
Related Id(s): <a href="https://github.com/erlang/otp/issues/SA-q7cq-pfgf-5hr7">GH-SA-q7cq-pfgf-5hr7</a>, <a href="https://github.com/erlang/otp/pull/11824">PR-11824</a>, OTP-20346</p>
</li>
</ul>
<blockquote>
<h4>Full runtime dependencies of snmp-5.20.6</h4>
<p>asn1-5.4, crypto-4.6, erts-12.0, kernel-8.0, mnesia-4.12,<br>
runtime_tools-1.8.14, stdlib-5.0</p>
</blockquote>
<h1><a name="p-23976-ssh-607-18" class="anchor" href="#p-23976-ssh-607-18" aria-label="Heading link"></a>ssh-6.0.7</h1>
<p>The ssh-6.0.7 application can be applied independently of other applications on<br>
a full OTP 29 installation.</p>
<h2><a name="p-23976-fixed-bugs-and-malfunctions-19" class="anchor" href="#p-23976-fixed-bugs-and-malfunctions-19" aria-label="Heading link"></a>Fixed Bugs and Malfunctions</h2>
<ul>
<li>
<p>Fixed a bug where SSH CLI sessions using {shell, {shell, start, <span class="chcklst-box fa fa-square-o" data-chk-src="257:0"></span>}} did not<br>
handle latin1-encoded put_chars messages from the Erlang shell. This caused<br>
exception output (e.g. “** exception error: …”) to not be displayed on the<br>
SSH client, and {unhandled_request, …} messages to appear on the daemon<br>
host.</p>
<p>Own Id: OTP-20359<br>
Related Id(s): <a href="https://github.com/erlang/otp/pull/11474">PR-11474</a></p>
</li>
<li>
<p>Fixed the following bugs in the SSH application:</p>
<ul>
<li>The SFTP client (ssh_sftp) checked the channel state record against 0<br>
instead of the exit status integer when handling an exit_status message. The<br>
success branch was therefore dead code, and every SFTP subsystem exit —<br>
including a clean exit with status 0 — was reported to callers as an error.<br>
A clean exit is now reported as a normal stop.</li>
<li>The SSH_FXP_EXTENDED_REPLY decoder in ssh_xfer bound only a single byte of<br>
the reply payload instead of the full binary (the pattern was missing a<br>
/binary specifier). This made SFTP extension operations such as<br>
<a href="mailto:statvfs@openssh.com">statvfs@openssh.com</a> fail with a function_clause crash whenever the payload<br>
was not exactly one byte.</li>
<li>The TCP forwarding acceptor supervisor used the default permanent restart<br>
strategy, causing the acceptor to be restarted unnecessarily when a<br>
forwarded socket closed normally. The child now uses a transient restart<br>
strategy.</li>
<li>The keyboard_interact_fun handling returned the atom nok instead of not_ok<br>
on an invalid response, causing a crash during SSH message encoding instead<br>
of a clean authentication rejection.</li>
<li>The ssh*client_channel catch pattern error:{undef, *} never matched Erlang’s<br>
actual error:undef exception, so a missing optional handle_call/3 or<br>
handle_cast/2 callback crashed the channel process instead of being ignored.<br>
The catch now matches error:undef and uses erlang:function_exported/3 to<br>
tell a genuinely missing optional callback (ignored, as before) from an<br>
undef raised deeper inside an implemented callback (now re-raised instead of<br>
being silently swallowed).</li>
<li>Both ssh_tcpip_forward_client and ssh_tcpip_forward_srv called<br>
gen_tcp:close(undefined) in terminate/2 when the forwarding socket was never<br>
established (or already closed), producing noisy crash reports on normal<br>
forward teardown. terminate/2 now handles the undefined socket.</li>
</ul>
<p>Own Id: OTP-20360<br>
Related Id(s): <a href="https://github.com/erlang/otp/pull/11561">PR-11561</a></p>
</li>
<li>
<p>Fixed an SSH port-forwarding acceptor crash triggered by a peer that connects<br>
and immediately resets the connection. Transient TCP errors from accept and<br>
peername are now handled gracefully instead of terminating the acceptor.</p>
<p>Own Id: OTP-20392<br>
Related Id(s): <a href="https://github.com/erlang/otp/pull/11720">PR-11720</a></p>
</li>
<li>
<p>When the max_channels limit is reached for a port-forwarding channel<br>
(direct-tcpip or forwarded-tcpip), the SSH daemon now refuses the individual<br>
channel with SSH_MSG_CHANNEL_OPEN_FAILURE and keeps the connection alive,<br>
instead of terminating the whole SSH connection. Port-forwarding channels now<br>
behave like session channels, which already survived the limit, and this<br>
matches OpenSSH. Applications that relied on the connection being closed when<br>
the channel limit was reached must instead handle the channel-open failure.</p>
<p>Own Id: OTP-20420<br>
Related Id(s): <a href="https://github.com/erlang/otp/pull/11708">PR-11708</a></p>
<p>*** POTENTIAL INCOMPATIBILITY ***</p>
</li>
</ul>
<blockquote>
<h4>Full runtime dependencies of ssh-6.0.7</h4>
<p>crypto-5.7, erts-14.0, kernel-10.3, public_key-1.6.1, runtime_tools-1.15.1,<br>
stdlib-8.0</p>
</blockquote>
<h1><a name="p-23976-ssl-1178-20" class="anchor" href="#p-23976-ssl-1178-20" aria-label="Heading link"></a>ssl-11.7.8</h1>
<p>Note! The ssl-11.7.8 application <em>cannot</em> be applied independently of other<br>
applications on an arbitrary OTP 29 installation.</p>
<pre data-code-wrap="erlang"><code class="lang-erlang"> On a full OTP 29 installation, also the following runtime
dependency has to be satisfied:
-- public_key-1.21.1 (first satisfied in OTP 29.0.1)
</code></pre>
<h2><a name="p-23976-fixed-bugs-and-malfunctions-21" class="anchor" href="#p-23976-fixed-bugs-and-malfunctions-21" aria-label="Heading link"></a>Fixed Bugs and Malfunctions</h2>
<ul>
<li>
<p>DoS attack prevention missed corner case, now fall back to the incomplete<br>
peer-only chain handling when paths/2 yields no path, restoring the OTP 28<br>
behavior and matching OpenSSL, curl and browsers. The digraph and its<br>
chain-length limit from PR <span class="hashtag-raw">#11343</span> are unchanged, so the DoS protection is<br>
preserved; the extra cost is one trust-store lookup, as for a leaf-only chain.</p>
<p>Own Id: OTP-20394<br>
Related Id(s): <a href="https://github.com/erlang/otp/issues/11620">GH-11620</a>, <a href="https://github.com/erlang/otp/pull/11662">PR-11662</a></p>
</li>
<li>
<p>The equivalent options dh and dhfile where unintentionally ignored and the<br>
default value was used instead.</p>
<p>Own Id: OTP-20408<br>
Related Id(s): ERIERL-1367, <a href="https://github.com/erlang/otp/pull/11692">PR-11692</a></p>
</li>
<li>
<p>Redesign TLS-1.3 auto client ticket handling to adhere to RFC single-use by<br>
consuming a ticket when offered removing it from the client ticket store. This<br>
resolves unnecessary connections errors for concurrent client connections that<br>
previously could end up trying to use the same ticket, or tickets being<br>
evicted form the client store when a client still needed to look it up.</p>
<p>Own Id: OTP-20418<br>
Related Id(s): <a href="https://github.com/erlang/otp/issues/11702">GH-11702</a>, <a href="https://github.com/erlang/otp/issues/11709">GH-11709</a>, <a href="https://github.com/erlang/otp/pull/11707">PR-11707</a></p>
</li>
<li>
<p>Validate the handshake message type when decoding TLS-1.3 hello extensions<br>
(RFC 8446 / RFC 9846). A malicious or man-in-the-middle TLS-1.3 server could<br>
send a NewSessionTicket carrying a zero-length early_data extension, which a<br>
client with automatic session-ticket management (session_tickets => auto)<br>
stored and then crashed on during a later resumption, taking down the<br>
node-global client ticket store and disrupting TLS-1.3 resumption for the<br>
whole node. Extensions are now decoded only in the handshake messages in which<br>
they are permitted, so such a ticket is ignored instead of poisoning the<br>
store. This avoids a denial-of-service possibility.</p>
<p>Own Id: OTP-20426<br>
Related Id(s): <a href="https://github.com/erlang/otp/pull/11773">PR-11773</a>, <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-94200">CVE-2026-94200</a></p>
</li>
<li>
<p>Fixed a TLS/DTLS session resumption flaw ((D)TLS-1.2 abbreviated handshake)<br>
where an SNI-aware server could resume a cached session even when the<br>
resumption request’s server_name differed from the one that established the<br>
session, violating RFC 6066 §3. In virtual-hosting deployments where several<br>
SNI names share one server certificate but apply different<br>
client-authentication trust, a client could resume a session established under<br>
one SNI name while connecting under another — bypassing the second virtual<br>
service’s client-authentication boundary and skipping the certificate<br>
exchange.</p>
<p>The server now binds the establishing SNI hostname to the session and refuses<br>
resumption (falling back to a full handshake) when the requested SNI differs.<br>
A request without SNI only matches a session established without SNI, so<br>
ordinary non-SNI resumption is unaffected.</p>
<p>As a related correction, a listener’s derived reuse_sessions default (enabled<br>
under verify_none) is no longer carried into an SNI virtual service that<br>
switches to verify_peer; such a service must enable reuse_sessions explicitly.</p>
<p>Own Id: OTP-20445<br>
Related Id(s): <a href="https://github.com/erlang/otp/pull/11773">PR-11773</a>, <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-105236">CVE-2026-105236</a></p>
</li>
</ul>
<blockquote>
<h4>Full runtime dependencies of ssl-11.7.8</h4>
<p>crypto-5.8, erts-16.0, inets-5.10.7, kernel-10.3, public_key-1.21.1,<br>
runtime_tools-1.15.1, stdlib-7.0</p>
</blockquote>
<h1><a name="p-23976-stdlib-811-22" class="anchor" href="#p-23976-stdlib-811-22" aria-label="Heading link"></a>stdlib-8.1.1</h1>
<p>The stdlib-8.1.1 application can be applied independently of other applications<br>
on a full OTP 29 installation.</p>
<h2><a name="p-23976-fixed-bugs-and-malfunctions-23" class="anchor" href="#p-23976-fixed-bugs-and-malfunctions-23" aria-label="Heading link"></a>Fixed Bugs and Malfunctions</h2>
<ul>
<li>
<p>A loop with Unreachable Exit Condition (‘Infinite Loop’) vulnerability in the<br>
<a href="https://erlang.org/doc/man/erl_tar"><code>erl_tar</code></a> module allowed an attacker who supplied a tar archive to cause a<br>
denial of service via a crafted GNU sparse member. This has been corrected.</p>
<p>In addition, when attempting to extract a tar file with a legal GNU sparse<br>
member, extraction could fail with a <code>badarg</code> exception. That has also been<br>
corrected.</p>
<p>Own Id: OTP-20447<br>
Related Id(s): <a href="https://github.com/erlang/otp/pull/11791">PR-11791</a>, <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-96596">CVE-2026-96596</a></p>
</li>
</ul>
<blockquote>
<h4>Full runtime dependencies of stdlib-8.1.1</h4>
<p>compiler-5.0, crypto-4.5, erts-16.0.3, kernel-11.0, sasl-3.0,<br>
syntax_tools-3.2.1</p>
</blockquote>
<h1><a name="p-23976-thanks-to-24" class="anchor" href="#p-23976-thanks-to-24" aria-label="Heading link"></a>Thanks to</h1>
<p>Alexey Aristov, Daniel Gorin, Marcelino Alberdi Pereira, Marko Mindek, Miguel<br>
Rubinos Rodríguez</p>
