EasyApache4 v25.88 Maintenance and Security Release

WebPros has released an update for EasyApache 4!  Take a look at some highlights below, and then join us on the cPanel Community Forums, Discord, or Reddit to talk about this update and much more. If you have additional questions, feel free to reach out on one of our social channels.

• ea-apache24
• EA-13576: Update ea-apache24 from v2.4.68 to v2.4.69
• (CVE-2026-42356) Low: limited RCE for some internal redirects to non-CGI files in CGI directories
• (CVE-2026-42528) Moderate: mod_dav shared lock overflow
• (CVE-2026-46729) Low: mod_heartmonitor denial of service
• (CVE-2026-47360) Low: mod_session: Session cookie not removed during internal redirect
• (CVE-2026-48005) Low: mod_auth_digest reauthentication attack
• (CVE-2026-56153) Low: mod_charset_lite: Heap overflow in finish_partial_char
• (CVE-2026-56154) Low: mod_rewrite use-after-free via %{LA-U:HTTP:...}
• (CVE-2026-56449) Low: mod_proxy_html: crash in dump_content
• (CVE-2026-57941) Moderate: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy
• (CVE-2026-58415) Low: mod_dav_fs property database read access
• (CVE-2026-59685) Moderate: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM
• (CVE-2026-59797) Low: mod_ssl SSLRequire allows .htaccess ap_expr file-function
• (CVE-2026-63045) Low: mod_proxy_ftp PASV address handling
• (CVE-2026-63292) Moderate: mod_vhost_alias stack overflow
• (CVE-2026-63686) Low: mod_xml2enc crash on charset conversion failure
• (CVE-2026-63718) Low: mod_proxy_uwsgi Transfer-Encoding response smuggling
• (CVE-2026-73636) Low: mod_auth_digest one-time-nonce replay attack
• (CVE-2026-73637) Low: mod_auth_digest DoS attack
• (CVE-2026-79768) Low: mod_userdir information disclosure
• (CVE-2026-93546) Moderate: mod_dav_fs namespace overflow