Erlang 29.0.4

Erlang/OTP 29.0.4 landed on July 27, 2026, and if you run a distributed Erlang cluster, this is the release you should read twice before rolling your eyes at yet another patch bump.

Six CVEs, One Headline

The patch package resolves 21 trouble reports, and the sequence numbers tell the real story: CVE-2026-42792, CVE-2026-47078, CVE-2026-54890, CVE-2026-55737, CVE-2026-55953, CVE-2026-58227. Six CVEs in a single point release is not a routine maintenance drop — it's a security release wearing a patch number's clothes.

Let's not get carried away: there's no evidence of mass exploitation here. But the one that deserves your full attention is CVE-2026-42792, a denial-of-service vector in epmd — the Erlang port mapper daemon. Ryan Moore found and responsibly disclosed it, and the fix ships in erts-17.0.4. If your epmd is reachable from anything other than localhost, the mitigation in this release is the difference between "annoying Tuesday" and "why is my whole node registry down."

The Applications That Actually Changed

Nine applications are patched in 29.0.4: compiler-10.0.3, crypto-5.9.2, diameter-2.7.2, erts-17.0.4, megaco-4.9.1, public_key-1.21.4, ssh-6.0.3, ssl-11.7.4, and stdlib-8.0.3. Every one of them can be applied independently to a full OTP 29 installation via otp_patch_apply — which is convenient, because not all of these fixes are created equal.

The crypto application is where the interesting bugs live:

• crypto:macN/5 crash — a supplied MacLength larger than the underlying hash's output used to crash the call; now it doesn't (OTP-20239).
• aead_cipher_init_nif segfault — failed argument validation in the NIF could take down the whole VM; that's a segfault in a crypto NIF, which is exactly the kind of thing you don't want in a production node (OTP-20241).
• chacha20_poly1305 buffer overread — a cipher key buffer overread in one of the most widely used AEAD ciphers on the internet (OTP-20244).

If you're doing TLS at scale, the ssh-6.0.3 and ssl-11.7.4 bumps matter to you. If you're doing telephony protocol work, megaco-4.9.1 is yours. The compiler fix (a false internal consistency check failure with setelement, OTP-20261) is small but real — the kind of thing that shows up as a weird compile-time error in code you didn't touch.

What You Should Actually Do

Upgrade. Not because 29.0.3 is bad — it isn't — but because the epmd mitigation and the crypto NIF fixes are the kind of changes you want in place before something finds them for you.

• If epmd is exposed beyond localhost, treat this as urgent. Check your firewall rules while you're at it.
• Roll the patched applications out with otp_patch_apply if you're not ready for a full 29.0.4 rebuild — that's exactly what the tool is for.
• Run your TLS and crypto test suites after upgrading. The chacha20_poly1305 overread fix changes behavior at the boundary where the bug lived.

The trajectory here is worth noting: OTP 29.0.3 shipped on July 2, and 29.0.4 follows less than four weeks later. That cadence is the OTP team telling you they're taking the security posture seriously — and that the release notes, not the marketing, are where the truth lives.