Erlang 29.0.5

Erlang/OTP 29.0.5 shipped on August 4, 2026, as the fifth patch in the OTP 29 series. Two applications are updated: erts-17.0.5 and ssh-6.0.4. Both fix bugs that matter for production deployments.

epmd Localhost Regression Fixed

erts-17.0.5 repairs a regression introduced in the previous patch release that prevented epmd (the Erlang port mapper daemon) from binding to localhost. If you upgraded to 29.0.4 and found distributed nodes struggling to register, this is the fix. The change is tracked as OTP-20275, tied to GH-11402 and PR-11409.

SSH Hardening for Cipher Alignment

ssh-6.0.4 makes the SSH client and server reject incoming packets that are not aligned to the cipher block size, as required by RFC 4253 section 6. For CBC ciphers, a timing-safe "packet discard" mechanism (a CVE-2008-5161 mitigation) keeps structural errors indistinguishable from MAC failures before disconnecting. AEAD and encrypt-then-MAC modes disconnect immediately on misalignment. This is tracked as OTP-20137 via PR-11110.

Upgrade Notes

Both applications can be applied independently to an existing OTP 29 installation using otp_patch_apply. erts-17.0.5 requires kernel-9.0, sasl-3.3 and stdlib-4.1; ssh-6.0.4 requires crypto-5.7, erts-14.0, kernel-10.3, public_key-1.6.1, runtime_tools-1.15.1 and stdlib-8.0. Standard patching workflow applies: check out tag OTP-29.0.5, build, and patch.