Erlang/OTP ↗

Erlang · Actively exploited

Track your version:Monitors Erlang/OTP and tailors your dashboard to that exact version.

29.1.2 · latest cycle100/100 Healthy

Auto-added after CISA flagged Erlang/OTP as actively exploited (KEV catalog). Version and lifecycle mapping is pending review, so this is assessed at the product level and is never reported as a confident "healthy".

Summary iPlain-English security verdict for Erlang/OTP, generated from its current health score, actively-exploited vulnerabilities, and latest supported version.

Erlang/OTP currently scores 100/100 — healthy. 1 actively-exploited vulnerability (CISA KEV) affects older releases (e.g. CVE-2025-32433) — staying on the latest supported version keeps you clear of it. The latest supported release is 29.1.2. It's on the latest patch with no significant known issues — keep it current.

Disclosure trend iNew CVEs published for Erlang/OTP each year (NVD). A higher bar means more disclosures that year — more scrutiny, not necessarily less safe.

'19

'20

'21

'22

'23

'24

'25

'26

Patch priority — what to act on iThe issues to fix first — actively exploited (CISA KEV) first, then by exploitation probability (EPSS), then severity. Each row's "→ fixed in" is the earliest version that patches it; "see advisory" means no fixed version is published.

Most urgent first — actively exploited, then likeliest to be exploited.

CVE-2025-32433 CRITICAL exploited Missing authentication EPSS 99% → fixed in 27.3.3 CVE-2023-48795 MEDIUM CWE-354 EPSS 94% → fixed in 26.2.1 CVE-2022-37026 CRITICAL EPSS 1% → fixed in 25.0.2 CVE-2016-10253 CRITICAL Memory corruption EPSS 1% → see advisory CVE-2026-28808 CRITICAL Incorrect authorization EPSS 1% → fixed in 28.4.2 CVE-2026-23941 CRITICAL CWE-444 EPSS 0% → fixed in 28.4.1

See all 41 known Erlang/OTP CVEs & security history →

Get alerted about Erlang/OTP

Be emailed the moment Erlang/OTP gets a newly exploited vulnerability (CISA KEV) or a release reaches end of life. Free · double opt-in · unsubscribe anytime.

We email only on real events for Erlang/OTP — no marketing, no sharing, and we never know what you run. Track your whole stack →

Versions & lifecycle iWhen each release line stops receiving security patches (end-of-life). After EOL there are no more fixes — plan upgrades before these dates.

How long each Erlang/OTP release line is supported — and when it sunsets. Select a line for its full report.

May11'29 Erlang/OTP 29EOL 2029-05-11

May20'28 Erlang/OTP 28EOL 2028-05-20

May20'27 Erlang/OTP 27EOL 2027-05-20

May26'26 Erlang/OTP 26ended 2026-05-26

May17'25 Erlang/OTP 25ended 2025-05-17

May10'24 Erlang/OTP 24ended 2024-05-10

Mar18'24 Erlang/OTP 22ended 2024-03-18

Mar14'24 Erlang/OTP 23ended 2024-03-14

Jun19'21 Erlang/OTP 21ended 2021-06-19

Jun21'20 Erlang/OTP 20ended 2020-06-21

Jun21'19 Erlang/OTP 19ended 2019-06-21

Nov9'18 Erlang/OTP 18ended 2018-11-09

Full Erlang/OTP end-of-life dates & support timeline →

29 latest 29.1.2 Supported until 2029-05-1129.1.2 → 28 latest 28.5.0.8 Supported until 2028-05-2028.5.0.8 → 27 latest 27.3.4.19 Supported until 2027-05-2027.3.4.19 → 26 latest 26.2.5.21 End of life ended 2026-05-2626.2.5.21 → 25 latest 25.3.2.21 End of life ended 2025-05-1725.3.2.21 → 24 latest 24.3.4.17 End of life ended 2024-05-1024.3.4.17 → 23 latest 23.3.4.20 End of life ended 2024-03-1423.3.4.20 → 22 latest 22.3.4.27 End of life ended 2024-03-1822.3.4.27 → 21 latest 21.3.8.24 End of life ended 2021-06-1921.3.8.24 → 20 latest 20.3.8.26 End of life ended 2020-06-2120.3.8.26 → See all upcoming end-of-life dates →

Frequently asked

Is Erlang/OTP safe and patched?

What should I do about Erlang/OTP now?

Upgrade Erlang/OTP to the latest supported release (29.1.2) or later, which clears the actively-exploited issues affecting older versions, then confirm against Erlang's official advisory.

Why is Erlang/OTP listed on IsItPatched?

Erlang/OTP was added automatically because CISA's Known Exploited Vulnerabilities (KEV) catalog flagged it as actively exploited in the wild. IsItPatched tracks its known CVEs, severity (CVSS), exploitation probability (EPSS) and KEV status from public data; its version and lifecycle mapping is verified over time.

Has Erlang/OTP been actively exploited?

Yes. CISA added Erlang/OTP to its Known Exploited Vulnerabilities (KEV) catalog after confirming exploitation in the wild — the triggering vulnerability is CVE-2025-32433. Make sure you are running a patched, supported version of Erlang/OTP and confirm it against Erlang's security advisory.

When does Erlang/OTP reach end-of-life?

The latest supported Erlang/OTP release is 29.1.2. After end-of-life a release no longer receives security patches.

Which versions of Erlang/OTP are still receiving security updates?

Supported Erlang/OTP release lines (latest 29.1.2): 29, 28, 27. End-of-life releases no longer receive security patches.

Informational only, from public data (NVD · CISA KEV · EPSS · endoflife.date), and can lag or miss vendor-specific fixes. Always confirm against Erlang's official advisory before you patch or upgrade — Erlang/OTP official site ↗