Erlang is a programming language used to build massively scalable soft
real-time systems with requirements on high availability. Some of its
uses are in telecoms, banking, e-commerce, computer telephony and
instant messaging. Erlang's runtime system has built-in support for
concurrency, distribution and fault tolerance.
This port contains a standalone runtime environment of Erlang 29
to be used during the development of OTP applications.
===> The following configuration options are available for erlang-runtime29-29.1.2_1:
CHUNKS=on: Enable in-line documentation in Erlang console
CORBA=on: Enable Corba support
DTRACE=on: Build with DTrace probes
JAVA=off: Java platform support
KQUEUE=on: Enable Kernel Poll (kqueue) support
ODBC=off: ODBC database backend
OPENSSL=on: SSL/TLS support via OpenSSL
SCTP=on: Enable SCTP support
SHARING=on: Enable term copy-and-share support
WX=off: Enable WX application
===> Use 'make config' to modify these settings
Affects: users of lang/erlang, lang/erlang-runtime27, lang/erlang-runtime28
and lang/erlang-runtime29 running an SSH daemon
Author: olgeni@FreeBSD.org
Reason:
OTP 29.1.1, 28.5.0.7 and 27.3.4.18 fix CVE-2026-68956, where the ssh
application did not enforce the max_channels daemon option for session
channels without an active subsystem. An authenticated client could open
an unbounded number of idle channels and exhaust the memory of the whole
Erlang VM.
As part of the fix, two ssh daemon defaults have changed:
max_channels infinity -> 256 (per connection)
max_sessions infinity -> 1024 (concurrent connections)
Deployments that legitimately need more than these limits must now set
them explicitly, for example:
ssh:daemon(Port, [{max_channels, infinity}, {max_sessions, infinity}])
The same releases also fix CVE-2026-89422 (TLS 1.3 client completes the
handshake without validating the server certificate when the ServerHello
carries an unsolicited pre_shared_key) and CVE-2026-65634 (superlinear
CPU denial-of-service in the asn1 OID decoder). Those need no
configuration changes.
lang/erlang-runtime29: Bump PORTREVISION
Required to ensure that RC-installed versions will upgrade to the final
release.
Fixes: e7938f387cbd0d667723f6d15422ecc62f568259
Sponsored by: SkunkWerks, GmbH
