# changelog

author: Dan Muey <daniel.muey@webpros.com> - 1.0-201
changelog:
  - ZC-12882: Re-order traffic log IPs format to match actual use
  - ZC-12882: switch domlogs from `%h` to `%a` to take advantage of real-ip


author: Cory McIntire <cory.mcintire@webpros.com> - 2.4.66-1
changelog:
  - EA-13281: Update ea-apache24 from v2.4.65 to v2.4.66
  	- low: Apache HTTP Server: mod_md (ACME), unintended retry intervals (CVE-2025-55753)
  	- low: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVE-2025-58098)
  	- moderate: Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF (CVE-2025-59775)
  	- low: Apache HTTP Server: CGI environment variable override (CVE-2025-65082)
  	- moderate: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo (CVE-2025-66200)


author: Cory McIntire <cory.mcintire@webpros.com> - 2.4.67-1
changelog:
  - EA-13423: Update ea-apache24 from v2.4.66 to v2.4.67
  	- important: Apache HTTP Server: http2: double free and possible RCE on early reset (CVE-2026-23918)
  	- moderate: Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr (CVE-2026-24072)
  	- moderate: Apache HTTP Server: mod_auth_digest timing attack (CVE-2026-33006)
  	- low: Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header() (CVE-2026-28780)
  	- low: Apache HTTP Server: mod_md unrestricted OCSP response (CVE-2026-29168)
  	- low: Apache HTTP Server: mod_dav_lock indirect lock crash (CVE-2026-29169)
  	- low: Apache HTTP Server: mod_authn_socache crash (CVE-2026-33007)
  	- low: Apache HTTP Server: multiple modules HTTP response splitting (CVE-2026-33523)
  	- low: Apache HTTP Server: off-by-one OOB reads in AJP getter functions (CVE-2026-33857)
  	- low: Apache HTTP Server: mod_proxy_ajp heap buffer over-read in ajp_msg_get_string (CVE-2026-34032)
  	- low: Apache HTTP Server: mod_proxy_ajp heap over-read in ajp_parse_data() (CVE-2026-34059)


author: Cory McIntire <cory.mcintire@webpros.com> - 2.4.67-3
changelog:
  - EA-13454: Backport mod_http2 v2.0.41 fix for CVE-2026-49975 (HTTP/2 Bomb - cookie LimitRequestFields bypass)


author: Cory McIntire <cory.mcintire@webpros.com> - 2.4.68-1
changelog:
  - EA-13458: Update ea-apache24 from v2.4.67 to v2.4.68
  - Remove CVE-2026-49975 backport patch (now fixed upstream in mod_http2 2.0.42)
  	- critical: Apache HTTP Server: mod_http2 DoS via memory allocation (CVE-2026-49975)
  	- critical: Apache HTTP Server: mod_http2 memory corruption (CVE-2026-48913)
  	- high: Apache HTTP Server: heap underflow in ap_regname (CVE-2026-44631)
  	- high: Apache HTTP Server: infinite loop in mod_proxy_ftp (CVE-2026-44186)
  	- high: Apache HTTP Server: stack buffer over-read in mod_ssl OCSP (CVE-2026-44185)
  	- high: Apache HTTP Server: privilege escalation via expressions (CVE-2026-44119)
  	- moderate: Apache HTTP Server: OOB read in merge_response_headers (CVE-2026-43951)
  	- moderate: Apache HTTP Server: mod_xml2enc heap overflow (CVE-2026-42536)
  	- moderate: Apache HTTP Server: mod_dav_fs protected directory access (CVE-2026-42535)
  	- moderate: Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow (CVE-2026-34356)
  	- moderate: Apache HTTP Server: mod_proxy_html buffer overflow (CVE-2026-34355)
  	- low: Apache HTTP Server: mod_proxy_ftp XSS (CVE-2026-29170)
  	- low: Apache HTTP Server: mod_ldap use-after-free (CVE-2026-29167)


author: Cory McIntire <cory.mcintire@webpros.com> - 1.10.16-3
changelog:
  - ZC-12614: Rolling “ea-scl-php-pear” back to “9bf382bf95619afb4023c729d76a50e1d98ac429”: merged accidentally


author: Cory McIntire <cory@cpanel.net> - 2.7.2-6
changelog:
  - EA-9609: Update ea-ruby27 from v2.7.1 to v2.7.2
    Adjusted release to -6 due to OBS build issues of the gems


author: Cory McIntire <cory@cpanel.net> - 2.7.8-1
changelog:
  - EA-11327: Update ea-ruby27 from v2.7.7 to v2.7.8
    CVE-2023-28755: ReDoS vulnerability in URI
    CVE-2023-28756: ReDoS vulnerability in Time


author: Cory McIntire <cory.mcintire@webpros.com> - 2.2.12-1
changelog:
  - EA-12745: Update ea-ruby27-rubygem-rack from v2.2.11 to v2.2.12
  - CVE-2025-27111 Possible Log Injection in Rack::Sendfile.


author: Cory McIntire <cory.mcintire@webpros.com> - 2.2.13-1
changelog:
  - EA-12755: Update ea-ruby27-rubygem-rack from v2.2.12 to v2.2.13
  - CVE-2025-27610 Local file inclusion in Rack::Static.


author: Cory McIntire <cory.mcintire@webpros.com> - 2.2.18-1
changelog:
  - EA-13163: Update ea-ruby27-rubygem-rack from v2.2.17 to v2.2.18
  - CVE-2025-59830 Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion via semicolon-separated parameters.


author: Cory McIntire <cory.mcintire@webpros.com> - 2.2.19-1
changelog:
  - EA-13174: Update ea-ruby27-rubygem-rack from v2.2.18 to v2.2.19
  - CVE-2025-61772 Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
  - CVE-2025-61771 Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
  - CVE-2025-61770 Unbounded multipart preamble buffering enables DoS (memory exhaustion)


author: EA4 Update Bot <cory.mcintire@webpros.com> - 2.2.23-1
changelog:
  - EA-13397: Update ea-ruby27-rubygem-rack from v2.2.22 to v2.2.23
  - CVE-2026-34830: Regex injection via X-Accel-Mapping header in Rack::Sendfile allows attacker to control nginx X-Accel-Redirect response header
  - CVE-2026-34785: Information disclosure in Rack::Static via partial string comparison allows access to files sharing a prefix with configured static dirs


author: Pavel Raiskup <praiskup@redhat.com> - 1-7
changelog:
  - the fix for 'filelist' (#1079203) is not needed, according to
    https://fedorahosted.org/SoftwareCollections/ticket/18


author: S. Kurt Newman <kurt.newman@cpanel.net> - 1.4-4
changelog:
  - Change bwlimited.conf to 0644 so that normal users can load modules
    the same as Apache while testing their configuration with 'httpd -t'
  - Also renamed configuration to 490_mod_bwlimited.conf to match the
    naming scheme of our other files.


author: Rishwanth Yeddula <rish@cpanel.net> - 1.0-1
changelog:
  - EA-7191: Initial implementation of mod_cpanel:
      * Handle requests to suspended users in apache without requiring
        an include file to be generated on the product side.


author: Rishwanth Yeddula <rish@cpanel.net> - 1.4-1
changelog:
  - EA-7821: Don't strip symbools from the debug package.
  - EA-7822: Handle edge cases where request_rec->filename == NULL.
      * Some modules that hook into the map_to_storage process (eg. mod_pagespeed),
        can alter the request_rec in an unexpected manner, that resulted
        result in a segfault.


author: S. Kurt Newman <kurt.newman@cpanel.net> - 2.3.9-7
changelog:
  - General cleanup (EA-5395)
  - Cleans up run/mod_fcgid directory when package is uninstalled (EA-5594)
  - Switch to rpm macros


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-73
changelog:
  - CLOS-2334: Minor mod_lsapi scripts corrections
  - CLOS-2348: Execute condition changed in switch_mod_lsapi script


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-75
changelog:
  - CLOS-2832: AlmaLinux support added
  - CLOS-2818: Changed requirement from alt-php56 to alt-php81
  - CLOS-2860: Added lsapi_get_status_line declaration


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-77
changelog:
  - CLOS-2951: Add support of alt-php 5.2-5.5 for Alma
  - CLOS-2904: Ignore errors in blacklisted config files


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-78
changelog:
  - CLOS-3055: Restore CRIU support in mod_lsapi DA tarballs
  - CLOS-3007: Add PHP 8.4 support as well as support of future PHP versions
  - CLOS-3007: Add heuristic to resolve unlisted PHP handlers
  - CLOS-3043: Add support of Ubuntu 22


author: Timur Averianov <taverianov@cloudlinux.com> 1.1-81
changelog:
  - CLOS-3184: Fix installation error on CL7+Plesk, leading to Apache service not starting; improve future upgrade reliability for other configurations


author:
  Timur Averianov <taverianov@cloudlinux.com> Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 1.1-86

changelog:
  - MAXWS-785: Fix backend termination script hanging in the background when there were too many processes
  - CLOS-3499: Update package to be compatible with CloudLinux 10


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> Timur Averianov <taverianov@cloudlinux.com> 1.1-87

changelog:
  - CLOS-3355: Set the docroot and domain information in the env before spawning lsphp
  - CLOS-3574: Use LSPHPRC instead of PHPRC if ea-php is version 8.4 and higher
  - CLOS-3646: Support RLIMITs


author: Cory McIntire <cory@cpanel.net> - 1.14.36.1-1
changelog:
  - EA-9560: Update ea-apache24-mod_pagespeed from vstable to v1.14.36.1
             Remove 32 bit logic and RPM


author: Cory McIntire <cory@cpanel.net> - 1.13.35.2-1
changelog:
  - EA-13373: Fix version to match actual shipped binary (was 1.14.36.1 in
    spec but 1.13.35.2 in SOURCES RPM since EA-7761). Add Epoch 1 for
    clean upgrade path.


author: Cory McIntire <cory@cpanel.net> - 1.14.36.1-1
changelog:
  - EA-9563: Update ea-apache24-mod_pagespeed from vstable to v1.14.36.1
             Remove 32 bit logic and RPM


author: Cory McIntire <cory@cpanel.net> - 2.9.7-1
changelog:
  - EA-11134: Update mod_security2 from v2.9.6 to v2.9.7
  - Security impacting issues
      Fix: FILES_TMP_CONTENT may sometimes lack complete content
      [Issue #2857 - gieltje, @airween, @dune73, @martinhsv]


author: Cory McIntire <cory.mcintire@webpros.com> - 2.9.8-1
changelog:
  - EA-12853: Update ea-apache24-mod_security2 from v2.9.7 to v2.9.8
  - Remove 2 patches that were added upstream.
  	- 0003-Import-some-memory-leak-fixes-for-Mod-Security-2.9.x.patch
  	- 0004-Allow-Lua-5.4.patch
  - Add new patch for re.c to allow it to build on Ubuntu
  - Add new patch for tests on Ubuntu 20


author: Dan Muey <daniel.muey@webpros.com> - 2.9.9-1
changelog:
  - EA-12885: Update ea-apache24-mod_security2 from v2.9.8 to v2.9.9
  - Possible DoS vulnerability: CVE-2025-47947


author: Dan Muey <daniel.muey@webpros.com> - 2.9.10-1
changelog:
  - ZC-12886: Update ea-apache24-mod_security2 from v2.9.9 to v2.9.10
  - DoS vulnerability: CVE-2025-48866


author: Cory McIntire <cory.mcintire@webpros.com> - 2.9.11-1
changelog:
  - EA-12994: Update ea-apache24-mod_security2 from v2.9.10 to v2.9.11
  - prevent segmentation fault if the XML node is empty: CVE-2025-52891


author: Dan Muey <daniel.muey@webpros.com> - 2.9.12-1
changelog:
  - EA-13061: Update ea-apache24-mod_security2 from v2.9.11 to v2.9.12
  - fix: Improper error handling CVE 2025-54571


author: Tim Mullin <tim@cpanel.net> - 1.7.2-1
changelog:
  - EA-11198: Update apr from v1.7.0 to v1.7.2
  - CVE-2022-24963
      Integer Overflow or Wraparound vulnerability in apr_encode functions of
      Apache Portable Runtime (APR) allows an attacker to write beyond bounds
      of a buffer.
  - CVE-2021-35940
      Restore fix for out-of-bounds array dereference in apr_time_exp*() functions.
      (This issue was addressed as CVE-2017-12613 in APR 1.6.3 and
      later 1.6.x releases, but was missing in 1.7.0.)


author: Cory McIntire <cory@cpanel.net> - 1.7.5-1
changelog:
  - EA-12350: Update apr from v1.7.4 to v1.7.5
  - SECURITY: CVE-2023-49582: Apache Portable Runtime (APR):
       Unexpected lax shared memory permissions (cve.mitre.org)
       Lax permissions set by the Apache Portable Runtime library on
       Unix platforms would allow local users read access to named
       shared memory segments, potentially revealing sensitive
       application data.
       This issue does not affect non-Unix platforms, or builds with
       APR_USE_SHMEM_SHMGET=1 (apr.h)
       Users are recommended to upgrade to APR version 1.7.5, which
       fixes this issue.
       Credits: Thomas Stangner


author: Tim Mullin <tim@cpanel.net> - 1.6.3-1
changelog:
  - EA-11199: Update apr-util from v1.6.1 to v1.6.3
  - CVE-2022-25147
      Integer Overflow or Wraparound vulnerability in apr_base64 functions
      of Apache Portable Runtime Utility (APR-util) allows an attacker to
      write beyond bounds of a buffer.


author: Jared Wright <jared.wright@webpros.com> - 1.0-123
changelog:
  - EA4-249: Add target-os package rename mapping support to ea_current_to_profile
  - EA4-249: Add ignore_deps support to package rename mappings


author: Brian Aker <brian@tangent.org> - 1.0.8
changelog:
  * Fri Jan  8 2010 Brian Aker <brian@tangent.org> - 0.37
  - Modified to be explicit in install include files.


author: Cory McIntire <cory@cpanel.net> - 2.13.3-2
changelog:
  - EA-12336: Rolling “ea-libxml2” back to “f77d3db2ad0957accee0eda34f1bb8bc66a9bb5c”: breaks older php-pears


author: Cory McIntire <cory.mcintire@webpros.com> - 2.13.6-1
changelog:
  - EA-12713: Update ea-libxml2 from v2.13.5 to v2.13.6
    - [CVE-2025-24928] Fix stack-buffer-overflow in xmlSnprintfElements
    - [CVE-2024-56171] Fix use-after-free after xmlSchemaItemListAdd


author: Cory McIntire <cory.mcintire@webpros.com> - 2.13.8-1
changelog:
  - EA-12821: Update ea-libxml2 from v2.13.6 to v2.13.8
  - [CVE-2025-32415] schemas: Fix heap buffer overflow in xmlSchemaIDCFillNodeTables
  - [CVE-2025-32414] python: Read at most len/4 characters. (Maks Verver)


author: Cory McIntire <cory@cpanel.net> - 1.10-2
changelog:
  - EA-12397: Rolling “ea-libzip” back to “a55dc085a3c6d8ccc95613a7f6acf4589fe405c2”: Version issues in happening in PHP compliations with this update


author: Cory McIntire <cory.mcintire@webpros.com> - 3.3.8-1
changelog:
  - EA-13308: Update ea-modsec2-rules-owasp-crs from v3.3.7 to v3.3.8
  - CVE-2026-21876: Rule 922110 only validates the LAST multipart part’s charset, allowing malicious charsets in earlier parts to bypass detection


author: EA4 Update Bot <cory.mcintire@webpros.com> - 3.3.9-1
changelog:
  - EA-13393: Update ea-modsec2-rules-owasp-crs from v3.3.8 to v3.3.9
  - CVE-2026-33691: File upload detection bypass via whitespace padding in PHP double-extension, PHP upload, and JSP file upload detection


author: Cory McIntire <cory@cpanel.net> - 1.61.0-1
changelog:
  - EA-12069: Update ea-nghttp2 from v1.60.0 to v1.61.0
  - CVE-2024-28182: Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage


author: Cory McIntire <cory.mcintire@webpros.com> - 1.68.1-2
changelog:
  - EA-13378: Add CVE documentation for nghttp2 1.68.1
  - CVE-2026-27135: Denial of service via assertion failure due to missing state validation (CVSS 7.5)


author: Cory McIntire <cory.mcintire@webpros.com> - 1.29.5-1
changelog:
  - EA-13333: Update ea-nginx from v1.29.4 to v1.29.5
  - Security: an attacker might inject plain text data in the response from an SSL backend (CVE-2026-1642).


author: Cory McIntire <cory.mcintire@webpros.com> - 1.29.7-1
changelog:
  - EA-13381: Update ea-nginx from v1.29.6 to v1.29.7
  - Security: buffer overflow in COPY or MOVE request handling with "alias" directive (CVE-2026-27654).
  - Security: processing of a specially crafted MP4 file by ngx_http_mp4_module on 32-bit platforms might cause a worker process crash (CVE-2026-27784).
  - Security: processing of a specially crafted MP4 file by ngx_http_mp4_module might cause a worker process crash (CVE-2026-32647).
  - Security: segmentation fault in worker process with CRAM-MD5 or APOP authentication when retry enabled (CVE-2026-27651).
  - Security: PTR DNS record injection in auth_http requests and XCLIENT command (CVE-2026-28753).
  - Security: SSL handshake succeeds despite OCSP rejecting client certificate in stream module (CVE-2026-28755).


author: Cory McIntire <cory.mcintire@webpros.com> - 1.31.0-1
changelog:
  - EA-13436: Update ea-nginx from v1.30.0 to v1.31.0
  - Security: heap buffer overflow in ngx_http_rewrite_module (CVE-2026-42945).


author: Cory McIntire <cory.mcintire@webpros.com> - 1.31.1-1
changelog:
  - EA-13448: Update ea-nginx from v1.31.0 to v1.31.1
  - Security: remote code execution via worker process memory pool handling (CVE-2026-9256).


author: EA4 Update Bot <cory.mcintire@webpros.com> - 1.31.3-1
changelog:
  - EA-13503: Update ea-nginx from v1.31.2 to v1.31.3
  - Security: heap buffer overflow when using map with regex, potentially allowing remote code execution or worker process denial of service via a crafted HTTP request (CVE-2026-42533).
  - Security: memory disclosure when using the ngx_http_slice_module (CVE-2026-60005).
  - Security: use-after-free when using the ngx_http_ssi_module (CVE-2026-56434).


author: Cory McIntire <cory@cpanel.net> - 16.19.1-1
changelog:
  - EA-11255: Update ea-nodejs16 from v16.19.0 to v16.19.1
  - [CVE-2023-23918) Node.js Permissions policies can be bypassed via process.mainModule (High)
  - [CVE-2023-23919) Node.js OpenSSL error handling issues in nodejs crypto library (Medium)
  - [CVE-2023-23920] Node.js insecure loading of ICU data through ICU_DATA environment variable (Low)
  - [CVE-2023-23936] Fetch API in Node.js did not protect against CRLF injection in host headers (Medium)
  - [CVE-2023-24807] Regular Expression Denial of Service in Headers in Node.js fetch API (Low)


author: Cory McIntire <cory@cpanel.net> - 16.20.2-1
changelog:
  - EA-11604: Update ea-nodejs16 from v16.20.1 to v16.20.2
  	- CVE-2023-32559: Policies can be bypassed via process.binding
  	- CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire
  	- CVE-2023-32002:  Policies can be bypassed via Module.\_load
  	- OpenSSL sources upgraded upstream to latest


author: Cory McIntire <cory@cpanel.net> - 18.19.1-1
changelog:
  - EA-11974: Update ea-nodejs18 from v18.19.0 to v18.19.1
  - CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High)
  - CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)
  - CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium)
  - CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)


author: Cory McIntire <cory@cpanel.net> - 18.20.1-1
changelog:
  - EA-12067: Update ea-nodejs18 from v18.20.0 to v18.20.1
  - CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash- (High)
  - CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation - (Medium)


author: Cory McIntire <cory@cpanel.net> - 18.20.2-1
changelog:
  - EA-12082: Update ea-nodejs18 from v18.20.1 to v18.20.2
  - Command injection via args parameter of child_process.spawn without shell option enabled on Windows (CVE-2024-27980) - (HIGH)


author: Cory McIntire <cory@cpanel.net> - 18.20.4-1
changelog:
  - EA-12274: Update ea-nodejs18 from v18.20.3 to v18.20.4
  	- CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High)
  	- CVE-2024-22020 - Bypass network import restriction via data URL (Medium)


author: Cory McIntire <cory@cpanel.net> - 18.20.6-1
changelog:
  - EA-12662: Update ea-nodejs18 from v18.20.5 to v18.20.6
  	- GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085) - (medium)
  	- Path traversal by drive name in Windows environment (CVE-2025-23084) - (medium)


author: Cory McIntire <cory@cpanel.net> - 20.18.2-1
changelog:
  - EA-12663: Update ea-nodejs20 from v20.18.1 to v20.18.2
  	- Worker permission bypass via InternalWorker leak in diagnostics (CVE-2025-23083) - (high)
  	- GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085) - (medium)
  	- Path traversal by drive name in Windows environment (CVE-2025-23084) - (medium)


author: Cory McIntire <cory.mcintire@webpros.com> - 20.19.2-1
changelog:
  - EA-12866: Update ea-nodejs20 from v20.19.1 to v20.19.2
  	- Improper error handling in async cryptographic operations crashes process (CVE-2025-23166) - (high)
  	- Improper HTTP header block termination in llhttp (CVE-2025-23167) - (medium)
  	- Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string. (CVE-2025-23165) - (low)


author: Cory McIntire <cory.mcintire@webpros.com> - 20.19.4-1
changelog:
  - EA-13026: Update ea-nodejs20 from v20.19.3 to v20.19.4
  - (CVE-2025-27210) Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()


author: Cory McIntire <cory.mcintire@webpros.com> - 20.20.0-1
changelog:
  - EA-13314: Update ea-nodejs20 from v20.19.6 to v20.20.0
  - CVE-2025-55132 - HTTP Request Smuggling vulnerability in permission model
  - CVE-2025-59465 - TLSSocket default error handler vulnerability


author: Cory McIntire <cory.mcintire@webpros.com> - 20.20.2-2
changelog:
  - EA-13383: Add CVE documentation for Node.js 20.20.2
  - CVE-2026-21637: Improper network access restriction (High)
  - CVE-2026-21710: Permission model bypass via fs.lstat (High)
  - CVE-2026-21713: HTTP/2 CONTINUATION frame flood (Medium)
  - CVE-2026-21714: Prototype pollution via vm.runInNewContext (Medium)
  - CVE-2026-21717: Path traversal in module resolution (Medium)
  - CVE-2026-21715: Timing side-channel in crypto.timingSafeEqual (Low)
  - CVE-2026-21716: Unsafe default TLS cipher in legacy mode (Low)


author: Cory McIntire <cory.mcintire@webpros.com> - 22.22.0-1
changelog:
  - EA-13315: Update ea-nodejs22 from v22.21.1 to v22.22.0
  - CVE-2025-55132 - HTTP Request Smuggling vulnerability in permission model
  - CVE-2025-59465 - TLSSocket default error handler vulnerability


author: Cory McIntire <cory.mcintire@webpros.com> - 22.22.2-2
changelog:
  - EA-13384: Add CVE documentation for Node.js 22.22.2
  - CVE-2026-21637: Improper network access restriction (High)
  - CVE-2026-21710: Permission model bypass via fs.lstat (High)
  - CVE-2026-21713: HTTP/2 CONTINUATION frame flood (Medium)
  - CVE-2026-21714: Prototype pollution via vm.runInNewContext (Medium)
  - CVE-2026-21717: Path traversal in module resolution (Medium)
  - CVE-2026-21715: Timing side-channel in crypto.timingSafeEqual (Low)
  - CVE-2026-21716: Unsafe default TLS cipher in legacy mode (Low)


author: Cory McIntire <cory.mcintire@webpros.com> - 22.23.0-2
changelog:
  - EA-13467: Add CVE documentation for Node.js 22.23.0
  - CVE-2026-48618: TLS hostname not normalized for server identity checks - wildcard certificate auth bypass (High)
  - CVE-2026-48933: WebCrypto cipher output length not guarded - AES integer overflow crash (High)
  - CVE-2026-48937: HTTP/2 sessions not cleaned up after GOAWAY on invalid protocol errors (Medium)
  - CVE-2026-48930: dns/net hostnames with embedded NUL bytes accepted - silent authority rebinding (Medium)
  - CVE-2026-48619: HTTP/2 originSet size uncapped - unbounded memory growth via ORIGIN frames (Medium)
  - CVE-2026-48615: HTTP proxy credentials leaked in ERR_PROXY_TUNNEL error messages (Medium)
  - CVE-2026-48934: TLS reusable sessions not bound to authenticated host - identity verification bypass (Medium)
  - CVE-2026-48928: TLS case-sensitive SNI context matching bypass in mTLS (Medium)
  - CVE-2026-48617: Permission model process.report.writeReport() path misvalidation bypass (Low)
  - CVE-2026-48931: HTTP response queue poisoning in http.Agent via TOCTOU race (Low)
  - CVE-2026-48935: Permission model FileHandle.utimes() read-only file restriction bypass (Low)


author: Dan Muey <dan@cpanel.net> - 1.0-2
changelog:
  - ZC-9259: Have setting script do defaults (so it can be done at will); use helper script instead of /dev/null for missing binaries


author: Cory McIntire <cory.mcintire@webpros.com> - 6.0.26-1
changelog:
  - EA-12725: Update ea-passenger-src from v6.0.25 to v6.0.26
    * [CVE-2025-26803] The http parser (from Passenger 6.0.21-6.0.25) was susceptible to a denial of service attack when parsing a request with an invalid HTTP method.


author: Dan Muey <daniel.muey@webpros.com> - 6.1.0-2
changelog:
  - EA4-223: Move A10 host-flag-support from Apache module that uses this src ball (that way NGINX benefits form it too w/out duplicating efforts)


author: Daniel Muey <dan@cpanel.net> - 1.0.0-1
changelog:
  - ZC-4400: rewrite to make it easier to work with and fix all the bugs
  - ZC-4425: deprecate -ea_php flag


author: Jack Hayhurst <jack@deleteos.com> - 0.2
changelog:
  - added ea-php71-php-memcahe branched off of php54

  - Fixed package name, entire RPM is now working.


author: Cory McIntire <cory.mcintire@webpros.com> - 7.4.33-15
changelog:
  - ZC-12614: Rolling “ea-php74” back to “2ae8a0c01d69dbc710734ff516c17a19a479fa13”: was not meant to be merged


author: Cory McIntire <cory@cpanel.net> - 8.0.30-1
changelog:
  - EA-11590: Update ea-php80 from v8.0.29 to v8.0.30
  	- Libxml:
  		Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading in XML without enabling it). (CVE-2023-3823)
  	- Phar:
  		Fixed bug GHSA-jqcx-ccgc-xwhv (Buffer mismanagement in phar_dir_read()). (CVE-2023-3824)


author: Cory McIntire <cory@cpanel.net> - 8.0.29-1
changelog:
  - EA-11475: Update ea-php80 from v8.0.28 to v8.0.29
      - Fixed bug GHSA-76gg-c692-v2mw
          (Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP).


author: Cory McIntire <cory@cpanel.net> - 8.1.31-1
changelog:
  - EA-12576: Update ea-php81 from v8.1.30 to v8.1.31
  - (Single byte overread with convert.quoted-printable-decode filter). (CVE-2024-11233)
  - (Configuring a proxy in a stream context might allow for CRLF injection in URIs). (CVE-2024-11234)
  - (Integer overflow in the dblib quoter causing OOB writes). (CVE-2024-11236)
  - (Integer overflow in the firebird quoter causing OOB writes). (CVE-2024-11236)
  - (Leak partial content of the heap through heap buffer over-read). (CVE-2024-8929)
  - (OOB access in ldap_escape). (CVE-2024-8932)


author: Cory McIntire <cory@cpanel.net> - 8.1.30-1
changelog:
  - EA-12428: Update ea-php81 from v8.1.29 to v8.1.30
  - Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026)
  - Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925)
  - Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926)
  - Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.1.32-1
changelog:
  - EA-12766: Update ea-php81 from v8.1.31 to v8.1.32
      - Fixed GHSA-hgf54-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
      - Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
      - Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
      - Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
      - Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header when requesting a redirected resource). (CVE-2025-1219)
      - Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown causes Use-After-Free). (CVE-2024-11235)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.1.33-1
changelog:
  - EA-13001: Update ea-php81 from v8.1.32 to v8.1.33
  	- Fixed GHSA-hrwm-9436-5mv3 (pgsql extension does not check for errors during escaping). (CVE-2025-1735)
  	- Fixed GHSA-453j-q27h-5p8x (NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix). (CVE-2025-6491)
  	- Fixed GHSA-3cr5-j632-f35r (Null byte termination in hostnames). (CVE-2025-1220)


author: Dan Muey <daniel.muey@webpros.com> - 8.1.34-1
changelog:
  - EA-13298: Update ea-php81 from v8.1.33 to v8.1.34
  - Fixed GHSA-8xr5-qppj-gvwj (PDO quoting result null deref). (CVE-2025-14180)
  - Fixed GHSA-h96m-rvf9-jgm2 (Heap buffer overflow in array_merge()). (CVE-2025-14178)
  - Fixed GHSA-3237-qqm7-mfv7 (Information Leak of Memory in getimagesize). (CVE-2025-14177)


author: Cory McIntire <cory.mcintire@webpros.com> - 14.4.0-1
changelog:
  - EA-12675: Update ea-ioncube14 from v14.0.0 to v14.4.0
  - Full release of PHP 8.4 loaders that will run encoded files produced by the PHP 8.3 & 8.2 Encoders.


author: Cory McIntire <cory@cpanel.net> - 8.2.26-1
changelog:
  - EA-12577: Update ea-php82 from v8.2.25 to v8.2.26
  - (Single byte overread with convert.quoted-printable-decode filter). (CVE-2024-11233)
  - (Configuring a proxy in a stream context might allow for CRLF injection in URIs). (CVE-2024-11234)
  - (Integer overflow in the dblib quoter causing OOB writes). (CVE-2024-11236)
  - (Integer overflow in the firebird quoter causing OOB writes). (CVE-2024-11236)
  - (Leak partial content of the heap through heap buffer over-read). (CVE-2024-8929)
  - (OOB access in ldap_escape). (CVE-2024-8932)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.2.28-1
changelog:
  - EA-12772: Update ea-php82 from v8.2.27 to v8.2.28
      - Fixed GHSA-hgf54-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
      - Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
      - Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
      - Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
      - Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header when requesting a redirected resource). (CVE-2025-1219)
      - Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown causes Use-After-Free). (CVE-2024-11235)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.2.29-1
changelog:
  - EA-12996: Update ea-php82 from v8.2.28 to v8.2.29
  - Fixed GHSA-3cr5-j632-f35r (Null byte termination in hostnames). (CVE-2025-1220)
  - Fixed GHSA-453j-q27h-5p8x (NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix). (CVE-2025-6491)
  - Fixed GHSA-hrwm-9436-5mv3 (pgsql extension does not check for errors during escaping). (CVE-2025-1735)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.2.30-1
changelog:
  - EA-13297: Update ea-php82 from v8.2.29 to v8.2.30
  - Fixed GHSA-8xr5-qppj-gvwj (PDO quoting result null deref). (CVE-2025-14180)
   -Fixed GHSA-h96m-rvf9-jgm2 (Heap buffer overflow in array_merge()). (CVE-2025-14178)
  - Fixed GHSA-3237-qqm7-mfv7 (Information Leak of Memory in getimagesize). (CVE-2025-14177)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.2.31-1
changelog:
  - EA-13427: Update ea-php82 from v8.2.30 to v8.2.31
  - Fixed GHSA-7qg2-v9fj-4mwv (XSS within FPM status endpoint). (CVE-2026-6735)
  - Fixed GHSA-wm6j-2649-pv75 (Null pointer dereference in mb_ereg_search_init()). (CVE-2026-7259)
  - Fixed GHSA-w476-322c-wpvm (SQL injection via NUL bytes in PDO_Firebird). (CVE-2025-14179)
  - Fixed GHSA-85c2-q967-79q5 (Stale SOAP_GLOBAL ref_map pointer). (CVE-2026-6722)
  - Fixed GHSA-m33r-qmcv-p97q (Use-after-free in SOAP persistence session). (CVE-2026-7261)
  - Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check in SOAP). (CVE-2026-7262)
  - Fixed GHSA-96wq-48vp-hh57 (Signed integer overflow of char array offset). (CVE-2026-7568)
  - Fixed GHSA-m8rr-4c36-8gq4 (Unsigned char handling in ctype.h functions). (CVE-2026-7258)


author: EA4 Update Bot <cory.mcintire@webpros.com> - 8.2.32-1
changelog:
  - EA-13482: Update ea-php82 from v8.2.31 to v8.2.32
  - Fixed bug GH-22187 (Memory corruption in openssl_encrypt with AES-WRAP-PAD). (CVE-2026-14355)


author: Dan Muey <daniel.muey@webpros.com> - 8.3.29-1
changelog:
  - EA-13295: Update ea-php83 from v8.3.28 to v8.3.29
  - Fixed GHSA-8xr5-qppj-gvwj (PDO quoting result null deref). (CVE-2025-14180)
  - Fixed GHSA-h96m-rvf9-jgm2 (Heap buffer overflow in array_merge()). (CVE-2025-14178)
  - Fixed GHSA-3237-qqm7-mfv7 (Information Leak of Memory in getimagesize). (CVE-2025-14177)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.3.31-1
changelog:
  - EA-13428: Update ea-php83 from v8.3.30 to v8.3.31
  - Fixed GHSA-7qg2-v9fj-4mwv (XSS within FPM status endpoint). (CVE-2026-6735)
  - Fixed GHSA-wm6j-2649-pv75 (Null pointer dereference in mb_ereg_search_init()). (CVE-2026-7259)
  - Fixed GHSA-w476-322c-wpvm (SQL injection via NUL bytes in PDO_Firebird). (CVE-2025-14179)
  - Fixed GHSA-85c2-q967-79q5 (Stale SOAP_GLOBAL ref_map pointer). (CVE-2026-6722)
  - Fixed GHSA-m33r-qmcv-p97q (Use-after-free in SOAP persistence session). (CVE-2026-7261)
  - Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check in SOAP). (CVE-2026-7262)
  - Fixed GHSA-96wq-48vp-hh57 (Signed integer overflow of char array offset). (CVE-2026-7568)
  - Fixed GHSA-m8rr-4c36-8gq4 (Unsigned char handling in ctype.h functions). (CVE-2026-7258)


author: EA4 Update Bot <cory.mcintire@webpros.com> - 8.3.32-1
changelog:
  - EA-13483: Update ea-php83 from v8.3.31 to v8.3.32
  - Fixed bug GH-21468 (TLS setup failure leading to remote DoS). (CVE-2026-12184)
  - Fixed bug GH-22187 (Memory corruption in openssl_encrypt with AES-WRAP-PAD). (CVE-2026-14355)


author: Dan Muey <daniel.muey@webpros.com> - 8.4.16-1
changelog:
  - EA-13296: Update ea-php84 from v8.4.15 to v8.4.16
  - Fixed GHSA-8xr5-qppj-gvwj (PDO quoting result null deref). (CVE-2025-14180)
  - Fixed GHSA-h96m-rvf9-jgm2 (Heap buffer overflow in array_merge()). (CVE-2025-14178)
  - Fixed GHSA-3237-qqm7-mfv7 (Information Leak of Memory in getimagesize). (CVE-2025-14177)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.4.21-1
changelog:
  - EA-13429: Update ea-php84 from v8.4.20 to v8.4.21
  - Fixed GHSA-7qg2-v9fj-4mwv (XSS within FPM status endpoint). (CVE-2026-6735)
  - Fixed GHSA-wm6j-2649-pv75 (Null pointer dereference in mb_ereg_search_init()). (CVE-2026-7259)
  - Fixed GHSA-w476-322c-wpvm (SQL injection via NUL bytes in PDO_Firebird). (CVE-2025-14179)
  - Fixed GHSA-85c2-q967-79q5 (Stale SOAP_GLOBAL ref_map pointer). (CVE-2026-6722)
  - Fixed GHSA-m33r-qmcv-p97q (Use-after-free in SOAP persistence session). (CVE-2026-7261)
  - Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check in SOAP). (CVE-2026-7262)
  - Fixed GHSA-96wq-48vp-hh57 (Signed integer overflow of char array offset). (CVE-2026-7568)
  - Fixed GHSA-m8rr-4c36-8gq4 (Unsigned char handling in ctype.h functions). (CVE-2026-7258)


author: EA4 Update Bot <cory.mcintire@webpros.com> - 8.4.23-1
changelog:
  - EA-13484: Update ea-php84 from v8.4.22 to v8.4.23
  - Fixed bug GH-22187 (Memory corruption in openssl_encrypt with AES-WRAP-PAD). (CVE-2026-14355)


author: Dan Muey <daniel.muey@webpros.com> - 8.5.1-1
changelog:
  - EA-13294: Update ea-php85 from v8.5.0 to v8.5.1
  - Fixed GHSA-8xr5-qppj-gvwj (PDO quoting result null deref). (CVE-2025-14180)
  - Fixed GHSA-h96m-rvf9-jgm2 (Heap buffer overflow in array_merge()). (CVE-2025-14178)
  - Fixed GHSA-3237-qqm7-mfv7 (Information Leak of Memory in getimagesize). (CVE-2025-14177)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.5.6-1
changelog:
  - EA-13430: Update ea-php85 from v8.5.5 to v8.5.6
  - Fixed GHSA-7qg2-v9fj-4mwv (XSS within FPM status endpoint). (CVE-2026-6735)
  - Fixed GHSA-wm6j-2649-pv75 (Null pointer dereference in mb_ereg_search_init()). (CVE-2026-7259)
  - Fixed GHSA-w476-322c-wpvm (SQL injection via NUL bytes in PDO_Firebird). (CVE-2025-14179)
  - Fixed GHSA-85c2-q967-79q5 (Stale SOAP_GLOBAL ref_map pointer). (CVE-2026-6722)
  - Fixed GHSA-m33r-qmcv-p97q (Use-after-free in SOAP persistence session). (CVE-2026-7261)
  - Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check in SOAP). (CVE-2026-7262)
  - Fixed GHSA-96wq-48vp-hh57 (Signed integer overflow of char array offset). (CVE-2026-7568)
  - Fixed GHSA-m8rr-4c36-8gq4 (Unsigned char handling in ctype.h functions). (CVE-2026-7258)


author: EA4 Update Bot <cory.mcintire@webpros.com> - 8.5.8-1
changelog:
  - EA-13485: Update ea-php85 from v8.5.7 to v8.5.8
  - Fixed bug GH-22187 (Memory corruption in openssl_encrypt with AES-WRAP-PAD). (CVE-2026-14355)


author: Cory McIntire <cory@cpanel.net> - 1.0-8
changelog:
  - EA-10834: Rolling “ea-podman” back to “547d2ef67731ef65145dd384c32ade79018f8180”: accidental merge to production


author: Julian Brown <julian.brown@cpanel.net> - 1.0-14
changelog:
  - ZC-10612: Add container name to output, and add better messaging when ea-podman package is not installed


author: Dan Muey <dan@cpanel.net> - 1.0-67
changelog:
  - ZC-11494: Rolling “ea-profiles-cpanel” back to “562229d”: scriptlets seem to be happening out of order on a9


author: Dan Muey <daniel.muey@webpros.com> - 1.0-73
changelog:
  - EA4-204: Update “allphp allphp-opcache default default-nginx mpm_itk worker” profile(s):  add “ea-php83” based on “ea-php81”


author: Cory McIntire <cory@cpanel.net> - 6.2.14-1
changelog:
  - EA-11922: Update ea-redis62 from v6.2.8 to v6.2.14
  - CVE-2023-45145 ( Bypass permissions on socket on startups )
  - CVE-2022-24834 ( RCE )
  - CVE-2023-28856 ( Users can crash redis with invalid data )
  - CVE-2023-25155 ( Integer overflow can cause redis to terminate )
  - CVE-2022-36021 ( DoS - can cause redis to hang and consume 100% CPU time )
  - CVE-2022-35977, CVE-2023-22458 ( integer overflow issues / oom panic fixes )


author: Cory McIntire <cory@cpanel.net> - 6.2.16-1
changelog:
  - EA-12449: Update ea-redis62 from v6.2.14 to v6.2.16
  - (CVE-2024-31449) Lua library commands may lead to stack overflow and potential RCE.
  - (CVE-2024-31228) Potential Denial-of-service due to unbounded pattern matching.


author: Cory McIntire <cory@cpanel.net> - 6.2.17-1
changelog:
  - EA-12624: Update ea-redis62 from v6.2.16 to v6.2.17
  - (CVE-2024-46981) Lua script commands may lead to remote code execution


author: Cory McIntire <cory.mcintire@webpros.com> - 6.2.19-1
changelog:
  - EA-13003: Update ea-redis62 from v6.2.18 to v6.2.19
  - (CVE-2025-32023) Fix out-of-bounds write in HyperLogLog commands
  - (CVE-2025-48367) Retry accepting other connections even if the accepted connection reports an error


author: Cory McIntire <cory.mcintire@webpros.com> - 6.2.20-1
changelog:
  - EA-13172: Update ea-redis62 from v6.2.19 to v6.2.20
  - CVE-2025-49844: Lua script may lead to remote code execution
  - CVE-2025-46817: Lua script may lead to integer overflow and potential RCE
  - CVE-2025-46818: Lua script can be executed in context of another user
  - CVE-2025-46819: LUA out-of-bound read


author: Travis Holloway <t.holloway@cpanel.net> - 2.7.2-6
changelog:
  - EA-9609: Install racc and irb and require ruby-devel for update to 2.7.2
    Adjusted release to -6 in order to match ea-ruby27 package


author: Cory McIntire <cory@cpanel.net> - 1.48.0-1
changelog:
  - EA-11958: Update ea-ruby27-libuv from v1.47.0 to v1.48.0
  - CVE-2024-24806: Improper Domain Lookup that potentially leads to SSRF attacks


author: Cory McIntire <cory@cpanel.net> - 1.49.0-2
changelog:
  - EA-12450: Rolling “ea-ruby27-libuv” back to “757c822adb9bc99291dfd5219b5afa32e63e1fd4”: upstream issue causing upload limit problems
  - Actual version is 1.48.0-3


author: Cory McIntire <cory.mcintire@webpros.com> - 10.1.47-1
changelog:
  - EA-13187: Update ea-tomcat101 from v10.1.46 to v10.1.47
  - Low: Delayed cleaning of multipart upload temporary files may lead to DoS CVE-2025-61795


author: Cory McIntire <cory.mcintire@webpros.com> - 10.1.50-1
changelog:
  - EA-13285: Update ea-tomcat101 from v10.1.49 to v10.1.50
  - Low: Security constraint bypass CVE-2026-24733
  - Moderate: Client certificate verification bypass due to virtual host mapping CVE-2025-66614


author: Cory McIntire <cory.mcintire@webpros.com> - 10.1.52-1
changelog:
  - EA-13328: Update ea-tomcat101 from v10.1.50 to v10.1.52
  - Moderate: Incomplete OCSP verification checks CVE-2026-24734


author: EA4 Update Bot <cory.mcintire@webpros.com> - 10.1.54-1
changelog:
  - EA-13399: Update ea-tomcat101 from v10.1.53 to v10.1.54
  - (CVE-2026-34486) Important: The fix for CVE-2026-29146 allowed the bypass of the EncryptInterceptor
  - (CVE-2026-34500) Moderate: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled
  - (CVE-2026-34487) Low: Cloud membership for clustering component exposed the Kubernetes bearer token
  - (CVE-2026-34483) Low: Incomplete escaping of JSON access logs


author: EA4 Update Bot <cory.mcintire@webpros.com> - 10.1.55-1
changelog:
  - EA-13434: Update ea-tomcat101 from v10.1.54 to v10.1.55
  - (CVE-2026-43515) Moderate: Security constraints not correctly applied
  - (CVE-2026-43512) Moderate: Digest authenticator will authenticate any unknown user
  - (CVE-2026-43514) Low: AJP secret compared in non-constant time
  - (CVE-2026-43513) Low: LockOutRealm treats user names as case-sensitive
  - (CVE-2026-42498) Low: WebSocket authentication header exposure
  - (CVE-2026-41293) Low: HTTP/2 request headers not validated
  - (CVE-2026-41284) Low: Unbounded read in WebDAV LOCK and PROPFIND handling


author: EA4 Update Bot <cory.mcintire@webpros.com> - 10.1.56-1
changelog:
  - EA-13475: Update ea-tomcat101 from v10.1.55 to v10.1.56
  - (CVE-2026-55956) Moderate: Security constraints for default servlet ignored method
  - (CVE-2026-55955) Low: EncryptInterceptor not protected against replay attacks
  - (CVE-2026-55276) Low: Logged effective web.xml is incomplete
  - (CVE-2026-53434) Low: Invalid CRL configuration doesn't trigger failure for FFM Connector
  - (CVE-2026-53404) Low: Bad ornext processing in RewriteValve
  - (CVE-2026-50229) Low: XSS in number guess example


author: Cory McIntire <cory@cpanel.net> - 7.2.8-1
changelog:
  - EA-12639: Update ea-valkey72 from v7.2.7 to v7.2.8
  	- (CVE-2024-46981) Lua script commands may lead to remote code execution. (#1513)
  	- (CVE-2024-51741) Denial-of-service due to malformed ACL selectors. (#1514)


author: Cory McIntire <cory.mcintire@webpros.com> - 7.2.9-1
changelog:
  - EA-12833: Update ea-valkey72 from v7.2.8 to v7.2.9
  - (CVE-2025-21605) Limit output buffer for unauthenticated clients


author: Cory McIntire <cory.mcintire@webpros.com> - 7.2.11-1
changelog:
  - EA-13165: Update ea-valkey72 from v7.2.10 to v7.2.11
  - CVE-2025-49844: Lua script may lead to remote code execution
  - CVE-2025-46817: Lua script may lead to integer overflow and potential RCE
  - CVE-2025-46818: Lua script can be executed in context of another user
  - CVE-2025-46819: LUA out-of-bound read


author: Cory McIntire <cory.mcintire@webpros.com> - 7.2.12-1
changelog:
  - EA-13358: Update ea-valkey72 from v7.2.11 to v7.2.12
  - (CVE-2026-21863) Remote DoS with malformed Valkey Cluster bus message (#3249)
  - (CVE-2025-67733) RESP Protocol Injection via Lua error_reply (#3249)


author: Cory McIntire <cory.mcintire@webpros.com> - 0.2.9-2
changelog:
  - EA4-267: Fix find-latest-version to use tag-based archive URL instead of tarball_url; replace bad tarball


author: Dan Muey <dan@cpanel.net> - 0.1-3
changelog:
  - ZC-10895: Add support for multiple Ubuntus as well as 22.04 && make `From repo` have OS info akin to `APT-Sources`


author: Darren Mobley <darren@cpanel.net> - 0.1-9
changelog:
  - HB-1952: Added support for sending an argument of --pkglist=/path/to/file
    that has a line by line list of each rpm package being handled by the 
    current operation to the wildcard scripts


author: Darren Mobley <darren@cpanel.net> - 0.1-9
changelog:
  - HB-1952: Added support for sending an argument of --pkglist=/path/to/file
    that has a line by line list of each rpm package being handled by the
    current operation to the wildcard scripts


author: Tim Mullin <tim@cpanel.net> - 2.4.54-1
changelog:
  - EA-10756: Update ea-apache2 from v2.4.53 to v2.4.54
    CVE-2022-26377: mod_proxy_ajp: Possible request smuggling
    CVE-2022-28330: Read beyond bounds in mod_isapi
    CVE-2022-28614: Read beyond bounds via ap_rwrite()
    CVE-2022-28615: Read beyond bounds in ap_strcmp_match()
    CVE-2022-29404: Denial of service in mod_lua r:parsebody
    CVE-2022-30522: mod_sed: Denial of service
    CVE-2022-30556: Information Disclosure in mod_lua with websockets
    CVE-2022-31813: mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism


author: Cory McIntire <cory@cpanel.net> - 2.4.55-1
changelog:
  - EA-11157: Update ea-apache2 from v2.4.54 to v2.4.55
  - CVE-2022-37436: Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting
  - CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp Possible request smuggling
  - CVE-2006-20001: Apache HTTP Server: mod_dav out of  bounds read, or write of zero byte


author: Tim Mullin <tim@cpanel.net> - 2.4.56-1
changelog:
  - EA-11284: Update ea-apache2 from v2.4.55 to v2.4.56
  - CVE-2023-27522: Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting
  - CVE-2023-25690: HTTP request splitting with mod_rewrite and mod_proxy


changelog:
  - switch_mod_lsapi --stat option added
  - MODLS-560: Installation of mod_lsapi package on DA added

author:
  Alexandr Demeshko <ademeshko@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-31


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-32
changelog:
  - MODLS-574: Started logics improvement
  - MODLS-573: add support alt-php7.3 for mod_lsapi (plesk) and ea-apache24-mod_lsapi
  - MODLS-565: lsapi_poll_timeout default-value 300


author:
  Sergey Kokhan <skokhan@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-33

changelog:
  - MODLS-590: Fixed stack overflow lscapi_do_request
  - MODLS-582: Update Copyright for mod_lsapi project
  - MODLS-589: fix lsapi_terminate_backends_on_exit and lsapi_reset_criu_on_apache_restart directives
  - MODLS-584: semtimedwait improvement
  - MODLS-580: stat support added for DA without mod_lsapi rpm
  - MODLS-481: fix stuck when bodyLen is wrong
  - MODLS-579: Remove LVE support from cpanel mod_lsapi
  - Fix exception in case if there are no liblsapi installed
  - MODLS-576: added absolute path for service util


author:
  Daria Kavchuk <dkavchuk@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-34

changelog:
  - MODLS-608: removed non-ascii symbol in copyright
  - MODLS-606: Fix lsapi_poll_timeout functionality
  - MODLS-600: fix mod_lsapi removal sets handler to none
  - MODLS-571: add support for httpd24-mod_lsapi usage statistics
  - MODLS-598: Fix permissions on config files
  - MODLS-587, MODLS-594: selector usage statistics added
  - MODLS-588: cpanel_mod_lsapi: put all of liblsapi's files into /opt/cpanel/ea-liblsapi/


author: Daniel Muey <dan@cpanel.net> - 1.1-36
changelog:
  - ZC-4779: Add ea-php73 to hardcoded list that rpm/switch_lsapi builds /etc/container/php.handler out of


author: Daniel Muey <dan@cpanel.net> - 1.1-37
changelog:
  - ZC-6114: Add ea-php74 to hardcoded list that rpm/switch_lsapi builds /etc/container/php.handler out of


author: Daniel Muey <dan@cpanel.net> - 1.1-41
changelog:
  - ZC-7213: Add ea-php80 to hardcoded list that rpm/switch_lsapi builds /etc/container/php.handler out of
  - bump release prefix to get back in sync w/ ea-liblsapi.spec
  - Add missing 7.3 and 7.4 entries for application/x-httpd-ea-php*-lsphp rpm/switch_lsapi


author: Daniel Muey <dan@cpanel.net> - 1.1-42
changelog:
  - ZC-9484: Add ea-php81 to hardcoded list that rpm/switch_lsapi builds /etc/container/php.handler out of


author: Dan Muey <dan@cpanel.net> - 1.1-43
changelog:
  - ZC-10388: Add ea-php82 to hardcoded list that rpm/switch_lsapi builds /etc/container/php.handler out of


author: Tim Mullin <tim@cpanel.net> - 2.9.3-18
changelog:
  - EA-10239: Increase compiler optimization level to help mitigate performance loss from large rulesets


author:
[cell repeats an earlier one in this file: 174 characters]

changelog:
  - MODLS-590: Fixed stack overflow lscapi_do_request
  - MODLS-582: Update Copyright for mod_lsapi project
  - MODLS-589: fix lsapi_terminate_backends_on_exit and lsapi_reset_criu_on_apache_restart directives
  - MODLS-584: semtimedwait improvement
  - MODLS-580: stat support added for DA without mod_lsapi rpm
  - MODLS-481: fix stuck when bodyLen is wrong


author: Kevin Fenzi <kevin@scrye.com> - 2.9.4-1
changelog:
  - Update to 2.9.4.
  - Apply very hacky patch that removes the no longer in python-3.6 PyVerify_fd symbol.


author: Dan Muey <dan@cpanel.net> - 2.9.7-1
changelog:
  - EA-7043: Update from v2.9.4 to v2.9.7
  - fixed %setup so that we do not need to modify tarball (EA-6094)
  - remove unreferenced 2.9.4-remove-pyverify_fd patch
  - Add Provides of libxml2


author: Cory McIntire <cory@cpanel.net> - 2.10.3-1
changelog:
  - EA-11205: Update ea-libxml2 from v2.9.7 to v2.10.3
  - [CVE-2022-23308] Use-after-free of ID and IDREF attributes
  - [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer
  - [CVE-2022-2309] Reset nsNr in xmlCtxtReset
  - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles
  - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE


author: Cory McIntire <cory@cpanel.net> - 2.10.4-1
changelog:
  - EA-11352: Update ea-libxml2 from v2.10.3 to v2.10.4
  - [CVE-2023-29469] Hashing of empty dict strings isn't deterministic
  - [CVE-2023-28484] Fix null deref in xmlSchemaFixupComplexType


author: Cory McIntire <cory@cpanel.net> - 2.11.1-1
changelog:
  - EA-11388: Update ea-libxml2 from v2.10.4 to v2.11.1
      - Security Fixes
      - Fix use-after-free in xmlParseContentInternal() (David Kilzer)
      - xmllint: Fix use-after-free with --maxmem
      - parser: Fix OOB read when formatting error message
      - entities: Rework entity amplification checks


author: Brian Mendoza <brian.mendoza@cpanel.net> - 1.23.3-3
changelog:
  - ZC-10317: Update ngx_http_pipelog_module to v1.0.3
  - ZC-10484: Remove SIGKILL from various nginx files
  - ZC-10517: Address Ubuntu creating addiotional splitlog processes
  - ZC-10593: Close out fd's during reload/shutdown
  - EA-11088: Account for mail subdomains of addon and parked domains when configuring the server_name directive
  - EA-11121: Add ipv6 subdomain to server_name directive when account has an ipv6 address assigned
  - EA-10890: Refactor _render_and_append() to use more data from global config data


author: Travis Holloway <t.holloway@cpanel.net> - 1.23.3-7
changelog:
  - EA-11269: Reduce frequency of nginx restarts during cpanellogd's domain log processing when piped logging is enabled


author: Travis Holloway <t.holloway@cpanel.net> - 1.24.0-2
changelog:
  - EA-11131: Ensure userdata reflects apache port changes when ea-nginx is removed
  - EA-11132: Ensure '/var/log/nginx.uninstall' does not exist before moving active log files there


author: Cory McIntire <cory@cpanel.net> - 8.0.25-1
changelog:
  - EA-11020: Update ea-php80 from v8.0.24 to v8.0.25
  - GD: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
  - Hash: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)


author: Cory McIntire <cory@cpanel.net> - 8.0.27-1
changelog:
  - EA-11137: Update ea-php80 from v8.0.26 to v8.0.27
  - PDO::quote() may return unquoted string). (CVE-2022-31631)


author: Cory McIntire <cory@cpanel.net> - 8.0.28-1
changelog:
  - EA-11227: Update ea-php80 from v8.0.27 to v8.0.28
  - Fixed bug #81744 (Password_verify() always return true with some hash). (CVE-2023-0567)
  - Fixed bug #81746 (1-byte array overrun in common path resolve code). (CVE-2023-0568)
  - Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart request body). (CVE-2023-0662)


author: Cory McIntire <cory@cpanel.net> - 8.1.12-1
changelog:
  - EA-11021: Update ea-php81 from v8.1.11 to v8.1.12
  - GD: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
  - Hash: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)


author: Cory McIntire <cory@cpanel.net> - 8.1.14-1
changelog:
  - EA-11133: Update ea-php81 from v8.1.13 to v8.1.14
  - PDO::quote() may return unquoted string). (CVE-2022-31631)


author: Cory McIntire <cory@cpanel.net> - 8.1.16-1
changelog:
  - EA-11244: Update ea-php81 from v8.1.15 to v8.1.16
  - Fixed bug #81744 (Password_verify() always return true with some hash). (CVE-2023-0567)
  - Fixed bug #81746 (1-byte array overrun in common path resolve code). (CVE-2023-0568)
  - Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart request body). (CVE-2023-0662)


author: Cory McIntire <cory@cpanel.net> - 8.2.1-1
changelog:
  - EA-11136: Update ea-php82 from v8.2.0 to v8.2.1
  - PDO::quote() may return unquoted string). (CVE-2022-31631)


author: Cory McIntire <cory@cpanel.net> - 8.2.3-1
changelog:
  - EA-11226: Update ea-php82 from v8.2.2 to v8.2.3
  - Fixed bug #81744 (Password_verify() always return true with some hash). (CVE-2023-0567)
  - Fixed bug #81746 (1-byte array overrun in common path resolve code). (CVE-2023-0568)
  - Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart request body). (CVE-2023-0662)


