| Notes from UPDATING |
- These upgrade notes are taken from /usr/ports/UPDATING
- 2026-09-25
Affects: users of lang/erlang, lang/erlang-runtime27, lang/erlang-runtime28
and lang/erlang-runtime29 running an SSH daemonAuthor: olgeni@FreeBSD.org Reason:
OTP 29.1.1, 28.5.0.7 and 27.3.4.18 fix CVE-2026-68956, where the ssh
application did not enforce the max_channels daemon option for session
channels without an active subsystem. An authenticated client could open
an unbounded number of idle channels and exhaust the memory of the whole
Erlang VM.
As part of the fix, two ssh daemon defaults have changed:
max_channels infinity -> 256 (per connection)
max_sessions infinity -> 1024 (concurrent connections)
Deployments that legitimately need more than these limits must now set
them explicitly, for example:
ssh:daemon(Port, [{max_channels, infinity}, {max_sessions, infinity}])
The same releases also fix CVE-2026-89422 (TLS 1.3 client completes the
handshake without validating the server certificate when the ServerHello
carries an unsolicited pre_shared_key) and CVE-2026-65634 (superlinear
CPU denial-of-service in the asn1 OID decoder). Those need no
configuration changes.
|
Number of commits found: 12
| Commit History - (may be incomplete: for full details, see links to repositories near top of page) |
| Commit | Credits | Log message |
29.1.1 24 Sep 2026 23:33:58
    |
Jimmy Olgeni (olgeni)  |
lang/erlang-runtime29: Update to 29.1.1
Security: 60eb0bba-b668-11f1-9d0e-4c526214c986 |
29.1 17 Sep 2026 08:11:40
    |
Jimmy Olgeni (olgeni)  |
lang/erlang-runtime29: Update to 29.1 |
29.0.6 01 Sep 2026 19:25:36
    |
Jimmy Olgeni (olgeni)  |
lang/erlang-runtime29: Update to 29.0.6 |
29.0.5 06 Aug 2026 07:59:10
    |
Jimmy Olgeni (olgeni)  |
lang/erlang-runtime29: Update to 29.0.5 |
29.0.4 28 Jul 2026 00:30:26
    |
Jimmy Olgeni (olgeni)  |
lang/erlang-runtime29: Update to 29.0.4 |
29.0.3 03 Jul 2026 08:26:37
    |
Jimmy Olgeni (olgeni)  |
lang/erlang-runtime29: Update to 29.0.3 |
29.0.2 11 Jun 2026 01:49:13
    |
Jimmy Olgeni (olgeni)  |
lang/erlang-runtime29: Update to 29.0.2
Security: CVE-2026-48855, CVE-2026-48856, CVE-2026-48858, CVE-2026-48859,
CVE-2026-48860, CVE-2026-49759, CVE-2026-49760 |
29.0.1 28 May 2026 05:27:19
    |
Jimmy Olgeni (olgeni)  |
lang/erlang-runtime29: Update to 29.0.1
Security: CVE-2026-42789, CVE-2026-42790, CVE-2026-42791 |
29.0_1 14 May 2026 06:58:17
    |
Dave Cottlehuber (dch)  |
lang/erlang-runtime29: Bump PORTREVISION
Required to ensure that RC-installed versions will upgrade to the final
release.
Fixes: e7938f387cbd0d667723f6d15422ecc62f568259
Sponsored by: SkunkWerks, GmbH |
29.0 14 May 2026 01:01:53
    |
Jimmy Olgeni (olgeni)  |
lang/erlang-runtime29: Update to 29.0 |
29.0 04 May 2026 05:30:24
    |
Dave Cottlehuber (dch)  |
lang/erlang-runtime29: make it match |
29.0 03 May 2026 20:46:43
    |
Dave Cottlehuber (dch)  |
lang/erlang-runtime29: Import RC3 from upstream
https://www.erlang.org/news/186
https://erlang.org/download/otp_src_29.0-rc3.readme
Sponsored by: SkunkWerks, GmbH |
Number of commits found: 12
|