chore(deps): update dependency erlang to v29.0.4 #13
Loading…
Reference in a new issue
No description provided.
Delete branch "renovate/erlang-29.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
29.0.3→29.0.429.0.5Release Notes
erlang/otp (erlang)
v29.0.4: OTP 29.0.4Compare Source
Check out the git tag OTP-29.0.4, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.
POTENTIAL INCOMPATIBILITIES
Mitigated a denial of service attack in epmd.
Thanks to Ryan Moore for finding and responsibly disclosing this vulnerability to the Erlang/OTP project.
Own Id: OTP-20136
Application(s): erts
Related Id(s): PR-11386, CVE-2026-42792
compiler-10.0.3
The compiler-10.0.3 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
compiler: Fix an internal consistency check failure with
setelementOwn Id: OTP-20261
Related Id(s): GH-11368, PR-11374
crypto-5.9.2
The crypto-5.9.2 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Fixed crash in
crypto:macN/5when suppliedMacLengthwas greater than length of what the underlying hash returned.Own Id: OTP-20239
Related Id(s): PR-11239
Fixed segfault in
crypto:aead_cipher_init_nifwhen argument validation fails.Own Id: OTP-20241
Related Id(s): PR-11330
Fix cipher key buffer overread for
chacha20_poly1305.Own Id: OTP-20244
Related Id(s): PR-11337
diameter-2.7.2
The diameter-2.7.2 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Fix infinite loop in
diameter_dist:route_session/2when avp other thanSession-Idhas zero length.Own Id: OTP-20242
Related Id(s): PR-11331
Fix crash in
diameter_dist:route_session/2whenSession-Id(code: 263) avp has zero length.Own Id: OTP-20243
Related Id(s): PR-11333
erts-17.0.4
The erts-17.0.4 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Mitigated a denial of service attack in epmd.
Thanks to Ryan Moore for finding and responsibly disclosing this vulnerability to the Erlang/OTP project.
Own Id: OTP-20136
Related Id(s): PR-11386, CVE-2026-42792
*** POTENTIAL INCOMPATIBILITY ***
Fixed heap corruption when an invalidly encoded tuple with an arity of 2^31 or larger is decoded from Erlang's External Term Format (binary_to_term).
Own Id: OTP-20214
Related Id(s): PR-11297, CVE-2026-55737
When send_timeout is set and send_timeout_close is set to true, a 'tcp_closed' message is expected when the timeout occurs, but that (message) was not delivered. This has now been fixed.
Own Id: OTP-20257
Related Id(s): GH-11319
A crafted External Term Format (ETF) payload could crash the runtime system.
Thanks to Paul Guyot for finding and responsibly disclosing this vulnerability to the Erlang/OTP project.
Own Id: OTP-20259
Related Id(s): PR-11386, CVE-2026-54890
Fixed a rounding error in 16-bit float conversion.
Own Id: OTP-20260
Related Id(s): GH-11332, PR-11334
megaco-4.9.1
The megaco-4.9.1 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Fixed a buffer overflow in the megaco flex scanner C driver. A property parm name exceeding 452 bytes in a text-encoded H.248 message could overflow a fixed-size error buffer, crashing the VM. The sprintf calls have been replaced with bounded snprintf.
Own Id: OTP-20237
Related Id(s): GH-SA-7xgh-gmgf-q2g7, PR-11323
public_key-1.21.4
The public_key-1.21.4 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
A certificate chain with crafted policyMappings extensions could cause exponential memory consumption during path validation, exploitable via TLS handshake. Chains exceeding a node-count cap are now rejected with {bad_cert, policy_tree_exceeded}.
Own Id: OTP-20251
Related Id(s): GH-SA-622p-qfh6-c352, PR-11372
ssh-6.0.3
The ssh-6.0.3 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
DH key exchange now enforces strict bounds (1 < e/f < p-1, 1 < K < p-1) on all paths, matching OpenSSH and Go. No interop impact.
Own Id: OTP-20229
Related Id(s): PR-11303
Validate DH group parameters (P, G) received from the server during DH-GEX key exchange. The client now rejects groups where P is smaller than 2048 bits or G is not in the range (1, P-1). The default minimum in dh_gex_limits has been raised to 2048 on both client and server.
Own Id: OTP-20258
Related Id(s): ERIERL-1341, PR-11369
ssl-11.7.4
Note! The ssl-11.7.4 application cannot be applied independently of other applications on an arbitrary OTP 29 installation.
Fixed Bugs and Malfunctions
Add pre TLS-1.3 client side validation of servers algorithm selection being part of clients offered algorithms, preventing in worst case MITM circumventing validation of server certificate tricking the client to trust the malicious MITM as it was a valid server. Note this check is already performed for TLS-1.3 clients.
Own Id: OTP-20240
Related Id(s): PR-11336, CVE-2026-55953
Prevent invalid cert chains to create cycles in chain building code used to handle chains that could be unordered or contain extraneous certs. This avoids a DoS attack possibility.
Own Id: OTP-20245
Related Id(s): PR-11343, CVE-2026-58227
Clarify that rsa_psk and anonymous key exchange algorithms are considered legacy. Also harden rsa_psk in same way as normal rsa key exchange.
Own Id: OTP-20248
Related Id(s): PR-11341
Harden SSL application to conform with best practice and RFC's. This will mostly improve error messages and conserve memory usage.
Own Id: OTP-20250
Related Id(s): PR-27944
A certificate chain with crafted policyMappings extensions could cause exponential memory consumption during path validation, exploitable via TLS handshake. Chains exceeding a node-count cap are now rejected with {bad_cert, policy_tree_exceeded}.
Own Id: OTP-20251
Related Id(s): GH-SA-622p-qfh6-c352, PR-11372
stdlib-8.0.3
The stdlib-8.0.3 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Fixed a bug where zip:unzip/1,2 and zip:extract/1,2 were vulnerable to a relative path traversal attack. A crafted zip archive containing entry names such as ../x/y could have caused files to be written outside the intended extraction directory.
Thanks to Jonatan Männchen and Zhang Delong for finding and responsibly disclosing this vulnerability to the Erlang/OTP project.
Own Id: OTP-20143
Related Id(s): PR-11386, CVE-2026-47078
Thanks to
a1x-an, Jonatan Männchen
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.