OSSEVA FOR ERLANG/OTP
Your broker is patched. Your runtime is not.
Erlang/OTP supports each major release for roughly three years. OTP 26 reached end of life on 26 May 2026. If you upgraded RabbitMQ but left the underlying OTP release where it was, the CVEs you are exposed to now live below the broker — in the VM, the TLS stack and the standard library.
Why now
OTP 26 went end of life on 26 May 2026
The Erlang/OTP team supports a major release for approximately three years — two years after its successor ships. OTP 24 ended 10 May 2024, OTP 25 ended 17 May 2025, and OTP 26 ended 26 May 2026. OTP 27 runs until 20 May 2027. A large share of production RabbitMQ sits on OTP 25 or 26 today and receives nothing.
The runtime is the blind spot in every messaging audit
Vulnerability scanners fingerprint the broker version and stop there. Erlang's TLS implementation, the SSH application, public_key and the crypto NIFs are all separate attack surface with their own advisories — and they sit beneath every AMQP connection you terminate. A patched RabbitMQ on an unpatched OTP is not a patched system.
Broker and runtime upgrades are coupled, which is why teams defer both
Each RabbitMQ release supports a narrow band of OTP versions, so moving the runtime usually forces a broker move and vice versa. That coupling is the reason clusters stall for years on a single combination. OSSeva patches the pair you are actually running so the upgrade becomes a planned project rather than an incident response.
Versions covered
All versions below receive active CVE patches from OSSeva. Version numbers in monospace are exact release identifiers.
| Version | Status | Active CVEs |
|---|---|---|
| OTP 24(Community EOL 10 May 2024 — OSSeva patched) | EOL | Clean |
| OTP 25(Community EOL 17 May 2025 — OSSeva patched) | EOL | Clean |
| OTP 26(Community EOL 26 May 2026 — OSSeva patched) | EOL | Clean |
| OTP 27(Community support to 20 May 2027) | Extended | Clean |
| OTP 28(Community support to 20 May 2028) | Current | Clean |
What you get
Three tiers — pick the level of engagement that matches your team's operational needs and compliance requirements.
OSSeva Patch
CVE patches for the OTP release your brokers actually run on.
- Security patches for OTP 24, 25 and 26 past community EOL
- TLS, SSH, public_key and crypto application coverage
- Matched RabbitMQ + OTP build pairs, tested together
- Signed artifacts (GPG) and OS packages
- CVE disclosure notifications
- Runtime and broker upgrade planning
- 24/7 managed operations
OSSeva Assure
Patch plus the OTP upgrade path mapped against your broker estate.
- Everything in Patch
- OTP and broker version compatibility matrix for your estate
- TLS configuration and cipher suite audit
- Distribution protocol and cookie security review
- SOC 2 / HIPAA attestation package
- Staged OTP upgrade plan with rollback
- 24/7 managed operations
OSSeva Operate
Full MSP: 24/7 BEAM monitoring, 15-min SLA, named Erlang engineers.
- Everything in Assure
- 24/7 scheduler, memory and process-count monitoring
- 15-minute P1 incident response SLA
- Named senior Erlang/OTP engineer
- Crash dump and BEAM-level incident forensics
- Rolling OTP upgrade execution across clusters
- Quarterly runtime capacity reviews
All tiers priced per cluster/application — not per core. Contact for pricing →
How it installs
OSSeva artifacts arrive via your existing package infrastructure. Pull the patched version the same way you pull upstream today — just from the OSSeva registry.
# The broker version is not the runtime version. Check both.
rabbitmqctl status | grep -A2 'Erlang'
# Or directly from the VM
erl -noshell -eval \
'io:format("~s~n",[erlang:system_info(otp_release)]), halt().'
# Full release string, including patch level
cat "$(erl -noshell -eval \
'io:format("~s",[code:root_dir()]), halt().')/releases/RELEASES" | head -1# Debian / Ubuntu
curl -fsSL https://artifacts.osseva.io/gpg | \
gpg --dearmor -o /usr/share/keyrings/osseva.gpg
echo "deb [signed-by=/usr/share/keyrings/osseva.gpg] \
https://artifacts.osseva.io/deb stable main" \
> /etc/apt/sources.list.d/osseva.list
apt update && apt install esl-erlang=1:26.2.5.21-osseva-1
# Container image with a matched broker + runtime pair
docker pull artifacts.osseva.io/rabbitmq:3.13.7-otp26-osseva-1Migrate from Unsupported community OTP builds
Teams running OTP 24, 25 or 26 from distribution packages or the Erlang Solutions repository stop receiving security updates once the community window closes — the packages remain installable, which is exactly why the exposure goes unnoticed. OSSeva ships drop-in replacement builds from the same release line, so the version string your application checks does not change.
Pricing model
OSSeva for Erlang/OTP is priced per cluster and is bundled at no additional cost with OSSeva for RabbitMQ.
Frequently asked questions
Which versions of RabbitMQ are past community end-of-life?
RabbitMQ 3.8.x, 3.9.x, 3.10.x, 3.11.x, and 3.12.x have all reached community EOL — meaning no further security patches or CVE fixes are released by the RabbitMQ maintainers for those versions. RabbitMQ 3.13.x reached EOL in late 2024. OSSeva delivers backported CVE patches for 3.11 through 3.13.
Which PostgreSQL versions are no longer receiving community security patches?
PostgreSQL 9.6 through 13 have all reached community EOL. PostgreSQL 11 reached EOL November 2023, PostgreSQL 12 reached EOL November 2024, and PostgreSQL 13 reaches EOL November 2025. OSSeva provides extended security patching for PostgreSQL 11, 12, and 13 for teams that cannot immediately migrate to PG 14 or later.
Is Spring Framework 5.3.x still supported?
Spring Framework 5.3.x reached its community OSS EOL on December 31, 2024. Broadcom's commercial support for Spring 5.3.x is also no longer available under standard terms. OSSeva delivers backported CVE patches for Spring Framework 5.3.x and Spring Boot 2.7.x under our extended lifecycle support program.
Which versions of Apache Kafka are EOL?
Apache Kafka versions 2.x and 3.0 through 3.4 are past their community supported window, meaning no further patch releases. Kafka 3.5 and 3.6 have reached or are approaching EOL. OSSeva supports Kafka 2.8 through 3.5 with backported security patches and compliance documentation.
What happened to Redis licensing? Can I still use Redis for free?
In March 2024, Redis Ltd. changed the Redis license from BSD-3-Clause to the Business Source License (BSL 1.1), which restricts use in competing database products. The Valkey project (a Linux Foundation fork) continues under BSD-3-Clause. OSSeva maintains BSD-licensed, CVE-patched builds of Redis 6.2 and 7.0 for enterprises that need verifiable open-source licensing alongside security coverage.
Is Node.js 18 still receiving security patches?
Node.js 18 (LTS 'Hydrogen') reached its end-of-life date in April 2025 and no longer receives security releases from the Node.js project. OSSeva delivers CVE patches for Node.js 18 for enterprise teams that have not yet migrated to Node.js 20 or 22.
Is Apache Tomcat 8.5 still supported?
Apache Tomcat 8.5 reached its community EOL in March 2024. OSSeva provides extended security patching for Tomcat 8.5.x for teams running Java EE 7 workloads that cannot immediately migrate to Tomcat 9.0 or 10.1.
What .NET versions does OSSeva support?
.NET 6 reached Microsoft end-of-support in November 2024. .NET 7 reached EOL in May 2024. OSSeva delivers CVE patches for .NET 6 and .NET 7 for teams that have not yet migrated to .NET 8 (LTS, supported through November 2026).
Ready to get Erlang/OTP patched and supported?
Start with a 45-minute discovery call. We confirm your version coverage, scope the engagement, and have you onboarded within your first quarter.