OSSEVA FOR ERLANG/OTP
Erlang/OTP 25 and 26 are end of life. Your broker still runs on them.
Erlang/OTP supports each major release for roughly three years. OTP 26 reached end of life on 26 May 2026. If you upgraded RabbitMQ but left the underlying OTP release where it was, the CVEs you are exposed to now live below the broker — in the VM, the TLS stack and the standard library.
Last reviewed
Trusted globally by enterprises
Why now
OTP 26 went end of life on 26 May 2026
The Erlang/OTP team supports a major release for approximately three years — two years after its successor ships. OTP 24 ended 10 May 2024, OTP 25 ended 17 May 2025, and OTP 26 ended 26 May 2026. OTP 27 runs until 20 May 2027. A large share of production RabbitMQ sits on OTP 25 or 26 today and receives nothing.
The runtime is the blind spot in every messaging audit
Vulnerability scanners fingerprint the broker version and stop there. Erlang's TLS implementation, the SSH application, public_key and the crypto NIFs are all separate attack surface with their own advisories — and they sit beneath every AMQP connection you terminate. A patched RabbitMQ on an unpatched OTP is not a patched system.
Broker and runtime upgrades are coupled, which is why teams defer both
Each RabbitMQ release supports a narrow band of OTP versions, so moving the runtime usually forces a broker move and vice versa. That coupling is the reason clusters stall for years on a single combination. OSSeva patches the pair you are actually running so the upgrade becomes a planned project rather than an incident response.
Versions covered
All versions below receive active CVE patches from OSSeva. Version numbers in monospace are exact release identifiers.
| Version | Status | Active CVEs |
|---|---|---|
| OTP 24(Community EOL 10 May 2024 — OSSeva patched) | EOL | Clean |
| OTP 25(Community EOL 17 May 2025 — OSSeva patched) | EOL | Clean |
| OTP 26(Community EOL 26 May 2026 — OSSeva patched) | EOL | Clean |
| OTP 27(Community support to 20 May 2027) | Extended | Clean |
| OTP 28(Community support to 20 May 2028) | Current | Clean |
What you get
Three tiers — pick the level of engagement that matches your team's operational needs and compliance requirements.
OSSeva Patch
CVE patches for the OTP release your brokers actually run on.
- Security patches for OTP 24, 25 and 26 past community EOL
- TLS, SSH, public_key and crypto application coverage
- Matched RabbitMQ + OTP build pairs, tested together
- Signed artifacts (GPG) and OS packages
- CVE disclosure notifications
- Runtime and broker upgrade planning
- 24/7 managed operations
OSSeva Assure
Patch plus the OTP upgrade path mapped against your broker estate.
- Everything in Patch
- OTP and broker version compatibility matrix for your estate
- TLS configuration and cipher suite audit
- Distribution protocol and cookie security review
- SOC 2 / HIPAA attestation package
- Staged OTP upgrade plan with rollback
- 24/7 managed operations
OSSeva Operate
Full MSP: 24/7 BEAM monitoring, 15-min SLA, named Erlang engineers.
- Everything in Assure
- 24/7 scheduler, memory and process-count monitoring
- 15-minute P1 incident response SLA
- Named senior Erlang/OTP engineer
- Crash dump and BEAM-level incident forensics
- Rolling OTP upgrade execution across clusters
- Quarterly runtime capacity reviews
All tiers priced per cluster/application — not per core. Contact for pricing →
How it installs
OSSeva artifacts arrive via your existing package infrastructure. Pull the patched version the same way you pull upstream today — just from the OSSeva registry.
# The broker version is not the runtime version. Check both.
rabbitmqctl status | grep -A2 'Erlang'
# Or directly from the VM
erl -noshell -eval \
'io:format("~s~n",[erlang:system_info(otp_release)]), halt().'
# Full release string, including patch level
cat "$(erl -noshell -eval \
'io:format("~s",[code:root_dir()]), halt().')/releases/RELEASES" | head -1# Debian / Ubuntu
curl -fsSL https://artifacts.osseva.io/gpg | \
gpg --dearmor -o /usr/share/keyrings/osseva.gpg
echo "deb [signed-by=/usr/share/keyrings/osseva.gpg] \
https://artifacts.osseva.io/deb stable main" \
> /etc/apt/sources.list.d/osseva.list
apt update && apt install esl-erlang=1:26.2.5.21-osseva-1
# Container image with a matched broker + runtime pair
docker pull artifacts.osseva.io/rabbitmq:3.13.7-otp26-osseva-1Migrate from Unsupported community OTP builds
Teams running OTP 24, 25 or 26 from distribution packages or the Erlang Solutions repository stop receiving security updates once the community window closes — the packages remain installable, which is exactly why the exposure goes unnoticed. OSSeva ships drop-in replacement builds from the same release line, so the version string your application checks does not change.
Pricing model
OSSeva for Erlang/OTP is priced per cluster and is bundled at no additional cost with OSSeva for RabbitMQ.
Frequently asked questions
Is Erlang/OTP 25 still supported?
No. The Erlang/OTP team supports only the three newest major releases, now OTP 29, 28 and 27. OTP 25 was first released on 18 May 2022, and its last patch release, 25.3.2.21, shipped on 8 May 2025. RabbitMQ 3.11 runs only on OTP 25, so those clusters cannot move the runtime without a broker upgrade. OSSeva ships patched OTP 25 builds today.
How long does Erlang/OTP support each major release?
The Erlang/OTP security policy supports the last three major releases with maintenance and security patches. OTP 29.0 shipped on 13 May 2026 and the latest release is 29.1.1, so OTP 29, 28 and 27 are supported and OTP 26 and older are not. Majors ship each May, so a release gets about three years before the third release after it ends its support.
Is OTP 26 still supported?
No. OTP 26 reached community end of life on 26 May 2026. It still runs, still reports a valid version, and still passes most inventory checks — which is why so many clusters are sitting on it. It does not receive security patches. OSSeva continues to ship patched OTP 26 builds for customers who cannot move the runtime yet.
Do I need to patch Erlang if I already patch RabbitMQ?
Yes. They are separate codebases with separate advisories. RabbitMQ is an Erlang application; the TLS termination, cryptography, SSH and networking beneath it come from OTP itself. A vulnerability in Erlang's TLS or public_key application is exploitable through the broker regardless of how current the broker is.
Can I upgrade OTP without upgrading RabbitMQ?
Only within the band each broker release supports. Every RabbitMQ version declares a minimum and maximum OTP release, and moving outside it will refuse to boot or fail in subtle ways under load. OSSeva's compatibility matrix maps your current pairs and identifies which upgrades can be done independently and which must be coordinated.
Does OSSeva cover Elixir applications running on patched OTP?
Yes. Elixir compiles to BEAM bytecode and runs on the same runtime, so OSSeva's patched OTP builds cover Elixir workloads including Phoenix applications. The Elixir standard library is a separate project with its own release cadence, and OSSeva covers it alongside the runtime for the Elixir versions you run.
Which other projects depend on Erlang/OTP?
The ones most often found in enterprise estates are RabbitMQ, ejabberd and MongooseIM for messaging, CouchDB for storage, and VerneMQ and EMQX for MQTT. All of them inherit whatever the underlying OTP release is exposed to, and all of them are frequently deployed with a runtime nobody has revisited since installation.
Ready to get Erlang/OTP patched and supported?
Start with a 45-minute discovery call. We confirm your version coverage, scope the engagement, and have you onboarded within your first quarter.