Erlang/OTP 26 end of life
Erlang/OTP 26 reached end of life on 26 May 2026. The Erlang/OTP team maintains each major release for roughly three years — about two years after its successor ships — so OTP 26 no longer receives security patches. It still runs and still reports a valid version, which is why so many clusters remain on it.
- End of life
- 26 May 2026
- Released
- May 2023
- Final release
- 26.2.5.21
- Successor
- OTP 27 or OTP 28
Date published by Erlang/OTP release policy, cross-checked against endoflife.date. We do not publish a lifecycle date we cannot source.
What actually stops on 26 May 2026
- Security patches for the OTP 26 branch, including the TLS, SSH, public_key and crypto applications
- Bug fixes and backports of any kind to 26.x
- Compatibility testing of new RabbitMQ releases against OTP 26
What actually breaks in the upgrade
The runtime does not move on its own
Every RabbitMQ release declares a minimum and maximum supported OTP version. Moving OTP 26 to 27 frequently forces a broker move as well, and the reverse is equally true. That coupling is the single biggest reason clusters stall on one combination for years — the change is never as small as it looks.
Check what else is on the runtime
OTP is not only underneath RabbitMQ. ejabberd, MongooseIM, CouchDB, VerneMQ and EMQX all run on it, and in most estates those were deployed by different teams at different times. An OTP upgrade plan that covers only the broker misses half the exposure.
Your options, costed honestly
Including the ones that do not involve buying anything from us.
| Option | What it is | Effort | Cost | Our view |
|---|---|---|---|---|
| Move to a supported OTP release | Upgrade the runtime to OTP 27 or 28. | Coordinated with the broker | Engineering time | The right destination. The constraint is that each RabbitMQ release supports a narrow band of OTP versions, so the runtime rarely moves alone. |
| Stay and accept the exposure | Keep the current OTP release with no security updates. | None | None until an audit or an incident | Common and rarely deliberate. The version still reports fine and passes inventory checks, which is exactly why it persists. |
| OSSeva extended support | Patched builds on the OTP line you already run. | Drop-in package or image | Per cluster | Keeps the broker/runtime pair intact while the upgrade is planned properly rather than executed against an audit deadline. |
What OSSeva does for Erlang/OTP 26
OSSeva patches this line
OSSeva ships patched OTP 26 builds, and pairs them with tested RabbitMQ versions so the broker and runtime move — or stay — together.
Erlang/OTP extended supportWhat your auditor will say
Requires that system components are protected from known vulnerabilities via security patches. A runtime with no upstream patch stream cannot satisfy this on its own, and the runtime is in scope even when the assessor only asked about the broker.
Vulnerability identification and remediation. Identification is satisfied by scanning; remediation is what fails when the fix does not exist for your release line.
Erlang/OTP 26: common questions
Is Erlang/OTP 26 still supported?
No. It reached community end of life on 26 May 2026. It still runs, still reports a valid version string and still passes most inventory checks. It does not receive security patches.
We patch RabbitMQ. Does that cover OTP 26?
No. They are separate codebases with separate advisories. The TLS termination, cryptography and networking beneath the broker come from OTP itself, and a vulnerability there is reachable through the broker regardless of how current the broker is.
How exposed is an unpatched OTP release, in practice?
Measurably. Our exposure study found that OTP 24 accumulated 22 CVE records after its end-of-life date, nine of them CVSS 7.0 or above, topping out at 10.0 — while RabbitMQ itself accumulated none over the same period. The advisories in this stack are concentrated in the runtime.
Still running Erlang/OTP 26?
Tell us the versions and the estate size. We will tell you honestly whether to upgrade or to buy cover — and we say 'upgrade' more often than you would expect.