Erlang/OTP 28.3.2

This release of Erlang/OTP can be built from source or installed using pre-built packages for your OS or third-party tools (such as kerl, asdf or mise).

docker run -it erlang:28.3.2
Erlang/OTP 28.3.2
View on github.com
Patch Package OTP 28.3.2
Git Tag OTP-28.3.2
Date 2026-02-20
Issue Id
CVE-2026-21620
System OTP
Release 28
Application

crypto-5.8.1 #

The crypto-5.8.1 application can be applied independently of other applications on a full OTP 28 installation.

OTP-19993
Related Id(s):

PR-10732

Fixed static linking of OpenSSL 3.5+ on Windows.

Full runtime dependencies of crypto-5.8.1

erts-9.0, kernel-6.0, stdlib-3.9

erts-16.2.1 #

The erts-16.2.1 application can be applied independently of other applications on a full OTP 28 installation.

OTP-19926
Related Id(s):

PR-10547

Fail the windows build properly when nsis is not recognised.

OTP-19958

Socket accept cancel could cause fatal crash (core dump) on Windows.

OTP-19962
Related Id(s):

PR-10616

Fixed bug in ets:update_counter/4 and ets:update_element/4 accepting and inserting a default tuple smaller than the keypos of the table. Such a tuple without a key element would make the table internally inconsistent and might lead to bad behavior at table access, like ERTS runtime crash.

Now a call to ets:update_counter/4 or ets:update_element/4 will fail with badarg if the key does not exist in the table and the default tuple is too small.

OTP-19978
Related Id(s):

PR-10664

A missing memory barrier when unlocking process locks could cause unexpected behavior on architectures with weak memory ordering such as for example ARM.

OTP-19983
Related Id(s):

GH-10651, PR-10696

A process could fail to wake from hibernation when a non‑message signal followed by a message signal arrived concurrently as the receiving process hibernated. If the process had a large heap, triggering a dirty GC, the wakeup could be lost.

This bug existed since OTP 27.0.

Full runtime dependencies of erts-16.2.1

kernel-9.0, sasl-3.3, stdlib-4.1

ssh-5.4.1 #

The ssh-5.4.1 application can be applied independently of other applications on a full OTP 28 installation.

OTP-19864
Related Id(s):

GH-8676, PR-10575

Fix handling of the SSH “each side may guess” key-exchange mechanism as defined in RFC 4253, Section 7.

OTP-19915
Related Id(s):

PR-10539

Fix ssh_file:encode handling of OpenSSH V1 private keys generated by public_key module. Also correct type specifications for OpenSSH V1 keys in ssh_file encode and decode operations.

Full runtime dependencies of ssh-5.4.1

crypto-5.0, erts-14.0, kernel-10.3, public_key-1.6.1, runtime_tools-1.15.1, stdlib-5.0, stdlib-6.0

stdlib-7.2.1 #

Note! The stdlib-7.2.1 application cannot be applied independently of other applications on an arbitrary OTP 28 installation.

   On a full OTP 28 installation, also the following runtime
   dependency has to be satisfied:
   -- erts-16.0.3 (first satisfied in OTP 28.0.3)
OTP-19962
Related Id(s):

PR-10616

Fixed bug in ets:update_counter/4 and ets:update_element/4 accepting and inserting a default tuple smaller than the keypos of the table. Such a tuple without a key element would make the table internally inconsistent and might lead to bad behavior at table access, like ERTS runtime crash.

Now a call to ets:update_counter/4 or ets:update_element/4 will fail with badarg if the key does not exist in the table and the default tuple is too small.

Full runtime dependencies of stdlib-7.2.1

compiler-5.0, crypto-4.5, erts-16.0.3, kernel-10.0, sasl-3.0, syntax_tools-3.2.1

tftp-1.2.4 #

The tftp-1.2.4 application can be applied independently of other applications on a full OTP 28 installation.

OTP-19981
Related Id(s):

PR-10706, CVE-2026-21620

An issue in the undocumented initial state option [{root_dir,Dir}] to the tftp_file module has been fixed. The request file name was just concatenated to Dir so it was possible to traverse above Dir by using “../” file path components. Now the option actually restricts local file operations to the Dir directory and subdirectories.

The initial state option and how to use it was previously undocumented, so it is unlikely that anyone would have used it without understanding its peculiarities.

The documentation of the TFTP application has also been clarified to make it obvious that the default server configuration allows read and write access to all files that are readable or writable by the user running the Erlang VM, and that the default configuration therefore should be avoided.

Thanks to Luigino Camastra at Aisle Research, for finding and reporting this issue.

Full runtime dependencies of tftp-1.2.4

erts-6.0, kernel-6.0, stdlib-5.0

Thanks To #

Daniel Hryzbil, Jan Uhlig