Erlang/OTP 29.0.3 patch release fixes numerous bugs across multiple applications including critical security vulnerabilities. The ssl application receives the most fixes, addressing five CVEs: DTLS cookie DoS (CVE-2026-54887), TLS MITM injection during handshake (CVE-2026-54891), TLS PSK parameter mismatch (CVE-2026-55952), DTLS server DoS race condition (CVE-2026-55950), and a TLS-1.3 session ticket validation bypass. The ssh application fixes a path-existence oracle in the SFTP server (CVE-2026-53422) and an infinite loop DoS via extended data messages (CVE-2026-54886). Other fixes include ERTS undefined behavior in qsort causing beam crashes, an ETS race condition, JIT code generation issues on AArch64, and a DNS truncation fallback regression in the kernel.
