Erlang/OTP 29.0.2 patch release fixes multiple security vulnerabilities and bugs across 12 applications. Security fixes include: a buffer overflow in SCTP parsing (erts, CVE-2026-49759) that could lead to RCE; a stack overflow in erl_interface for large integers (CVE-2026-49760); SSRF/FTP bounce attack via improper passive mode IP validation (ftp, CVE-2026-48858); credential leakage on HTTP redirects (inets, CVE-2026-48856); SSH timing-based username enumeration (CVE-2026-48859); SSH SFTP path disclosure (CVE-2026-48855); and TLS distribution LAN enforcement bypass (ssl, CVE-2026-48860). Non-security fixes include Dialyzer native record bugs, gen_tcp_socket option inheritance, stdlib record operation crashes, and SSH keep-alive race conditions.
