--- title: OTP Patch Releases Address Security Vulnerabilities and... description: Multiple security patches have been released for OTP versions 26, 27, and 28, addressing critical vulnerabilities in SSH and HTTP components. Key fixes include... canonical: https://daily.dev/posts/otp-patch-releases-address-security-vulnerabilities-and-performance-improvements-z8lvlyryg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: OTP Patch Releases Address Security Vulnerabilities and Performance Improvements | daily.dev og:description: Multiple security patches have been released for OTP versions 26, 27, and 28, addressing critical vulnerabilities in SSH and HTTP components. Key fixes include... og:url: https://daily.dev/posts/otp-patch-releases-address-security-vulnerabilities-and-performance-improvements-z8lvlyryg og:image: https://api.daily.dev/og/posts/Z8lvlYryG.png og:image:alt: OTP Patch Releases Address Security Vulnerabilities and Performance Improvements og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # OTP Patch Releases Address Security Vulnerabilities and Performance Improvements **[Collections](https://daily.dev/sources/collections)** · 2 min read · 1 upvotes · 0 comments ## Summary Multiple security patches have been released for OTP versions 26, 27, and 28, addressing critical vulnerabilities in SSH and HTTP components. Key fixes include SSH file handle limits, KEX message validation, HTTP proxy pollution prevention, and the httpoxy attack vulnerability (CVE-2016-1000107). The patches also include PCRE2 updates to resolve buffer overflow issues and various bug fixes across core applications. ## Content Recent patch releases for OTP versions 26.2.5.15, 27.3.4.3, 28.0.3, and 28.0.4 address several security vulnerabilities, particularly in SSH and HTTP components, while also incorporating critical CVE fixes. ### OTP 26.2.5.15 This patch release focuses on security improvements within SSH and HTTP components. Important updates include the addition of new configuration options for SSH file handle limits, path length restrictions, and KEX message validation. Additionally, HTTP proxy pollution issues and RFC compliance violations in the inets application are resolved. ### OTP 27.3.4.3 The patch for OTP 27 addresses several security vulnerabilities, notably in SSH components. Key updates involve new configuration options for SFTP file handle limits and KEX message validation. It also fixes bugs related to the compiler's bit syntax and enhances Unicode character conversion in ERTS. Furthermore, HTTP proxy pollution issues within the inets application are addressed to improve security. ### OTP 28.0.3 The release of OTP 28.0.3 primarily focuses on fixing SSH-related vulnerabilities and integrates several CVE fixes. Key changes include refining configuration for SFTP file handle limits and KEX message processing. An update to PCRE2 version 10.46 resolves buffer overflow issues, and various applications such as diameter, erts, ssh, and stdlib receive important bug fixes. ### OTP 28.0.4 A critical security vulnerability (CVE-2016-1000107) in the inets application is fixed in the OTP 28.0.4 patch. This bug allowed HTTP requests to potentially pollute the HTTP_PROXY environment variable in servers using CGI scripts, known as the httpoxy attack. The patch updates the inets application to version 9.4.1 and can independently apply to full OTP 28 installations. These patch releases ensure enhanced security and performance improvements across various versions of OTP, reinforcing robust defenses against emerging vulnerabilities. ## Similar posts on daily.dev - [Don’t just attend KubeCon \+ CloudNativeCon, Merge Forward your experience\!](https://daily.dev/posts/don-t-just-attend-kubecon-cloudnativecon-merge-forward-your-experience--l0rpp73x8) · CNCF · 1 upvotes · 0 comments - [Announcing H2 2026 KCDs](https://daily.dev/posts/announcing-h2-2026-kcds-m96goajm1) · CNCF · 1 upvotes · 0 comments - [Two months of Open Community Groups](https://daily.dev/posts/two-months-of-open-community-groups-asf52zhbs) · CNCF · 0 upvotes · 0 comments - [CNCF Unveils Schedule for KubeCon \+ CloudNativeCon Europe 2026](https://daily.dev/posts/cncf-unveils-schedule-for-kubecon-cloudnativecon-europe-2026-ikhcoa5cb) · CNCF · 2 upvotes · 0 comments - [CNCF Debuts KubeCon \+ CloudNativeCon Japan 2026 Schedule](https://daily.dev/posts/cncf-debuts-kubecon-cloudnativecon-japan-2026-schedule-xp5pyudub) · CNCF · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#authentication](https://daily.dev/tags/authentication), [#ssh](https://daily.dev/tags/ssh), [#erlang](https://daily.dev/tags/erlang) [View this post on daily.dev](https://daily.dev/posts/otp-patch-releases-address-security-vulnerabilities-and-performance-improvements-z8lvlyryg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"OTP Patch Releases Address Security Vulnerabilities and Performance Improvements","url":"https://daily.dev/posts/otp-patch-releases-address-security-vulnerabilities-and-performance-improvements-z8lvlyryg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/otp-patch-releases-address-security-vulnerabilities-and-performance-improvements-z8lvlyryg"},"datePublished":"2025-09-10T14:45:43.244Z","dateModified":"2025-09-11T10:55:40.224Z","description":"Multiple security patches have been released for OTP versions 26, 27, and 28, addressing critical vulnerabilities in SSH and HTTP components. Key fixes include...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/30a15dbf39929078ecd91ef0f412a153?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/30a15dbf39929078ecd91ef0f412a153?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/otp-patch-releases-address-security-vulnerabilities-and-performance-improvements-z8lvlyryg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,authentication,ssh,erlang","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"OTP Patch Releases Address Security Vulnerabilities and Performance Improvements"}]} ```