EasyApache4 v25.89 Maintenance and Security Release

WebPros has released an update for EasyApache 4!  Take a look at some highlights below, and then join us on the cPanel Community Forums, Discord, or Reddit to talk about this update and much more. If you have additional questions, feel free to reach out on one of our social channels.

• ea-apache24-mod_security2
• EA-13574: Update ea-apache24-mod_security2 from v2.9.14 to v2.9.15
• (CVE-2026-61812) moderate: HTML entity decoder missing entities, leading to evasion
• (CVE-2026-61813) low: Incorrect libcurl TLS hostname verification for remote rules download
• (CVE-2026-73857) high: XML request body processor uninitialized pointer dereference
• (CVE-2026-104259) moderate: removeComments fails to strip adjacent comments, enabling rule bypass
• (CVE-2026-104269) high: Multipart filename* parameter bypasses filename rules
• EA-13583: Build against PCRE2 on all Ubuntu versions

• ea-apache24-mod-passenger
• EA-13533: Rebuild against ea-passenger-src v6.2.0

• ea-nginx-passenger
• EA-13533: Rebuild against ea-passenger-src v6.2.0

• ea-openssl11  (only supported on CentOS 7) 
• EA-13575: Patch ea-openssl11 for multiple CVEs
• (CVE-2026-84782) high: DTLS retransmits handshake messages from a stale buffer offset
• (CVE-2026-35189) low: Excessive memory allocation in relative CRLDP processing
• (CVE-2026-54872) low: Timing side-channel in scalar multiplication for non-NIST EC curves
• (CVE-2026-75806) low: Unauthenticated and undersized DTLS 1.2 AEAD record causes DoS
• (CVE-2026-77696) low: Timing side-channel in SM2 signature generation

• ea-passenger-src
• EA-13533: Update ea-passenger-src from v6.1.8 to v6.2.0
• Fix an unauthenticated Passenger Watchdog API and a Watchdog privilege escalation.
• Note: Passenger 6.2.0 changes one behavior. An empty watchdog_api_server_authorizations now allows no authentication instead of skipping it.

• ea-ruby27-passenger
• EA-13534: Update ea-ruby27-passenger from v6.1.8 to v6.2.0

• ea-ruby27-rubygem-nokogiri
• EA-13582: Update ea-ruby27-rubygem-nokogiri from v1.11.7 to v1.15.7
• (CVE-2022-24836) high: Inefficient regular expression complexity
• (CVE-2022-29181) high: Improper handling of unexpected data type