EasyApache4 v25.90 Maintenance and Security Release

WebPros has released an update for EasyApache 4!  Take a look at some highlights below, and then join us on the cPanel Community Forums, Discord, or Reddit to talk about this update and much more. If you have additional questions, feel free to reach out on one of our social channels.

• ea-libcurl
• EA-13549: Patch ea-libcurl 8.17.0 for multiple CVEs
• (CVE-2026-80255) low: Secure cookie attribute bypass with a tab
• (CVE-2026-80230) low: OpenSSL public key pinning bypass with no server certificate
• (CVE-2026-18924) low: HTTP/2 server push use-after-free with a shared connection cache
• (CVE-2025-14524) low: Bearer token leak on cross-protocol redirect
• (CVE-2025-14819) low: OpenSSL partial chain store policy bypass
• (CVE-2026-5773) low: Wrong reuse of SMB connection

• ea-libzip
• EA-13589: Update ea-libzip from v1.11.4 to v1.12

• ea-passenger-src
• EA-13588: Vendor the cxx_hinted_parser submodule so builds are deterministic

• ea-podman
• EA4-315, EA4-321, EA4-335: Replace the ea_podman adminbin with an in-process admin module, ship the ea-podman CLI uncompiled, add the ea_podman feature, stop tearing down running user systemd managers on systemd 252, and report why podman create failed
• CPANEL-57608: Release reserved host ports when a container install fails
• CPANEL-57396: Stop account backups from storing container files up to four times; the pkgacct hook now writes only a small manifest

• ea-tomcat101
• EA-13592: Update ea-tomcat101 from v10.1.60 to v10.1.61