# changelog

author: Cory McIntire <cory.mcintire@webpros.com> - 2.4.63-1
changelog:
  - EA-12665: Update ea-apache24 from v2.4.62 to v2.4.63
  - Remove Proxy FCGI patch (upstream patched in v2.5.63)


author: Dan Muey <daniel.muey@webpros.com> - 2.4.64-3
changelog:
  - EA-13041: Rolling “ea-apache24” back to “35b37d6c7295199c5157c68145f220d9fa61ff02”: Apache v2.4.64 broke SNI (rando 421)


author: Cory McIntire <cory.mcintire@webpros.com> - 2.4.66-1
changelog:
  - EA-13281: Update ea-apache24 from v2.4.65 to v2.4.66
  	- low: Apache HTTP Server: mod_md (ACME), unintended retry intervals (CVE-2025-55753)
  	- low: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVE-2025-58098)
  	- moderate: Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF (CVE-2025-59775)
  	- low: Apache HTTP Server: CGI environment variable override (CVE-2025-65082)
  	- moderate: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo (CVE-2025-66200)


author: Cory McIntire <cory.mcintire@webpros.com> - 2.4.67-1
changelog:
  - EA-13423: Update ea-apache24 from v2.4.66 to v2.4.67
  	- important: Apache HTTP Server: http2: double free and possible RCE on early reset (CVE-2026-23918)
  	- moderate: Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr (CVE-2026-24072)
  	- moderate: Apache HTTP Server: mod_auth_digest timing attack (CVE-2026-33006)
  	- low: Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header() (CVE-2026-28780)
  	- low: Apache HTTP Server: mod_md unrestricted OCSP response (CVE-2026-29168)
  	- low: Apache HTTP Server: mod_dav_lock indirect lock crash (CVE-2026-29169)
  	- low: Apache HTTP Server: mod_authn_socache crash (CVE-2026-33007)
  	- low: Apache HTTP Server: multiple modules HTTP response splitting (CVE-2026-33523)
  	- low: Apache HTTP Server: off-by-one OOB reads in AJP getter functions (CVE-2026-33857)
  	- low: Apache HTTP Server: mod_proxy_ajp heap buffer over-read in ajp_msg_get_string (CVE-2026-34032)
  	- low: Apache HTTP Server: mod_proxy_ajp heap over-read in ajp_parse_data() (CVE-2026-34059)


author: Cory McIntire <cory.mcintire@webpros.com> - 2.4.67-3
changelog:
  - EA-13454: Backport mod_http2 v2.0.41 fix for CVE-2026-49975 (HTTP/2 Bomb - cookie LimitRequestFields bypass)


author: Aleksandr Demeshko <ademeshko@cloudlinux.com> Nikolay Petukhov <npetukhvov@cloulinux.com> - 1.0-40
changelog:
  - AAP-510: log level changed to WARN for limited requests
  - AAP-493: Improved log output
  - AAP-508: Allowed AllowedHandlers and DenyHandlers directives inside Directory, Location and Files contexts


author: Timur Averianov <taverianov@cloudlinux.com> 1.1-81
changelog:
  - CLOS-3184: Fix installation error on CL7+Plesk, leading to Apache service not starting; improve future upgrade reliability for other configurations


author:
  Timur Averianov <taverianov@cloudlinux.com> Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 1.1-86

changelog:
  - MAXWS-785: Fix backend termination script hanging in the background when there were too many processes
  - CLOS-3499: Update package to be compatible with CloudLinux 10


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> Timur Averianov <taverianov@cloudlinux.com> 1.1-87

changelog:
  - CLOS-3355: Set the docroot and domain information in the env before spawning lsphp
  - CLOS-3574: Use LSPHPRC instead of PHPRC if ea-php is version 8.4 and higher
  - CLOS-3646: Support RLIMITs


author: Nika Keshelava <nkeshelava@cloudlinux.com>, Serhii Kokhan <skokhan@cloudlinux.com> 1.1-93
changelog:
  - CLOS-1655: Add CRIU support for CL9 and CL10
  - CLOS-4290: Minor fixes in request parsing and configuration scripts


changelog: - Initial MaxCache implementation for CloudLinux
author:
  Danila Vershinin <dvershinin@cloudlinux.com>, Sandro Kalatozishvili <skalatozishvili@cloudlinux.com>, Sergey Kokhan <skokhan@cloudlinux.com> - 1.0.0-1


author: Serhii Kokhan <skokhan@cloudlinux.com> - 1.1.0-1
changelog:
  - MAXWS-1043: Remove htcache-watchd dependency; use per-request stat() polling (RevalidateInterval=0)
  - MAXWS-1042: Rename MaxCacheHTCache* directives to MaxCacheHtaccess*; old names kept as deprecated aliases
  - MAXWS-1042: Rename htcache-status handler to maxcache-htaccess-status; old name kept as deprecated alias
  - MAXWS-1042: Rename config file maxcache_htcache.conf to maxcache_htaccess.conf with migration


author: Cory McIntire <cory@cpanel.net> - 1.7.5-1
changelog:
  - EA-12350: Update apr from v1.7.4 to v1.7.5
  - SECURITY: CVE-2023-49582: Apache Portable Runtime (APR):
       Unexpected lax shared memory permissions (cve.mitre.org)
       Lax permissions set by the Apache Portable Runtime library on
       Unix platforms would allow local users read access to named
       shared memory segments, potentially revealing sensitive
       application data.
       This issue does not affect non-Unix platforms, or builds with
       APR_USE_SHMEM_SHMGET=1 (apr.h)
       Users are recommended to upgrade to APR version 1.7.5, which
       fixes this issue.
       Credits: Thomas Stangner


author: Dan Muey <daniel.muey@webpros.com> - 1.29.1-1
changelog:
  - EA-13069: Update ea-nginx from v1.26.3 to v1.29.1
  - CVE-2025-53859: A security issue in ngx_mail_smtp_module,which might allow an attacker to cause buffer over-read


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> alutsiuk <alutsiuk@cloudlinux.com> - 3:1.29.1-1.cloudlinux

changelog:
  - MAXWS-821: Fixed ea-nginx build after merge of nginx-1.29.1 version
  - MAXWS-793: Bump conflict version for max_webserver
  - MAXWS-756: Remove lsapi_check_script directive from cpanel-lsapi.conf
  - MAXWS-673: Implemented varmatch block based on precompiled action handlers


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 3:1.29.1-1.cloudlinux.1
changelog:
  - MAXWS-821: Evaluate varmatch block for access directives in the access phase
  - MAXWS-828: Added return and return_status_code directives support in varmatch block
  - MAXWS-849: Added remove_type directive support in nginx
  - MAXWS-851: Normalize varmatch regex with base= to match filenames
  - MAXWS-828: Fixed error_page usage in varmatch if defined in global context
  - MAXWS-861: Fixed regex normalization and matching under varmatch subdirs
  - MAXWS-889: Re-evaluate varmatch rules against the resolved index file URI


author: Cory McIntire <cory.mcintire@webpros.com> - 1.29.5-1
changelog:
  - EA-13333: Update ea-nginx from v1.29.4 to v1.29.5
  - Security: an attacker might inject plain text data in the response from an SSL backend (CVE-2026-1642).


author: Cory McIntire <cory.mcintire@webpros.com> - 1.29.7-1
changelog:
  - EA-13381: Update ea-nginx from v1.29.6 to v1.29.7
  - Security: buffer overflow in COPY or MOVE request handling with "alias" directive (CVE-2026-27654).
  - Security: processing of a specially crafted MP4 file by ngx_http_mp4_module on 32-bit platforms might cause a worker process crash (CVE-2026-27784).
  - Security: processing of a specially crafted MP4 file by ngx_http_mp4_module might cause a worker process crash (CVE-2026-32647).
  - Security: segmentation fault in worker process with CRAM-MD5 or APOP authentication when retry enabled (CVE-2026-27651).
  - Security: PTR DNS record injection in auth_http requests and XCLIENT command (CVE-2026-28753).
  - Security: SSL handshake succeeds despite OCSP rejecting client certificate in stream module (CVE-2026-28755).


author: Cory McIntire <cory.mcintire@webpros.com> - 1.31.0-1
changelog:
  - EA-13436: Update ea-nginx from v1.30.0 to v1.31.0
  - Security: heap buffer overflow in ngx_http_rewrite_module (CVE-2026-42945).


author: Cory McIntire <cory.mcintire@webpros.com> - 1.31.1-1
changelog:
  - EA-13448: Update ea-nginx from v1.31.0 to v1.31.1
  - Security: remote code execution via worker process memory pool handling (CVE-2026-9256).


author: CloudLinux <packages@cloudlinux.com> - 0.64-7
changelog:
  * Thu Apr 16 2026 Cory McIntire <cory.mcintire@webpros.com> - 0.64-7
  - EA-13411: Build against ea-nginx version v1.30.0


author: CloudLinux <packages@cloudlinux.com> - 0.9.6-5
changelog:
  * Thu Apr 16 2026 Cory McIntire <cory.mcintire@webpros.com> - 0.9.6-5
  - EA-13411: Build against ea-nginx version v1.30.0


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.3.33-13.cloudlinux.1
changelog:
  - Security fixes
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.3.33-13.cloudlinux.2
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - Bug #74960: fix heap buffer overflow via str_repeat
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.3.33-13.cloudlinux.4
changelog:
  - Security fixes
  - CVE-2017-8923: fix integer overflow when concatenating strings
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.3.33-13.cloudlinux.5
changelog:
  - Security fixes
  - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.3.33-13.cloudlinux.7
changelog:
  - Security fixes
  - CVE-2025-1220: fix null byte termination in hostnames
  - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large
    XML namespace prefix


author: Arseniy Zolotarev <azolotarev@cloudlinux.com> - 1:7.3.33-15.cloudlinux.3
changelog:
  - EA4D-746: Update php-fpm lve patch to extract doc_root from php_admin_values
    for CageFS per-domain isolation


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 1:7.3.33-15.cloudlinux.6
changelog:
  - EA4D-789: Security fixes
  - CVE-2025-14178: fix integer overflow in array_merge (ext/standard/array.c)
  - CVE-2025-1736: fix for PHP SOAP extension


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.3.33-15.cloudlinux.9
changelog:
  - EA4D-797: revert to use system libxml2 lib for all platforms
  - EA4D-811: remove libphp7.so from _root_httpd_moddir to fix file conflicts


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 1:7.3.33-15.cloudlinux.11
changelog:
  - ALTPHP-2422: Disable OPcache SCCP pass (bit 0x80) in default optimization_level
    to avoid runtime infinite loop caused by SCCP+DFA miscompilation
    (e.g. WordPress wp_replace_in_html_tags on CloudLinux 10 + cPanel)


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 1:7.3.33-15.cloudlinux.12
changelog:
  - CLOS-4167: Add per-domain site isolation support to LiteSpeed SAPI; updated DEB LiteSpeed SAPI source to 8.3


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.3.33-13.cloudlinux.5
changelog:
  - EA4D-789: Security fixes
  - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.3.33-13.cloudlinux.7
changelog:
  - EA4D-789: Security fixes
  - CVE-2025-1220: fix null byte termination in hostnames
  - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large
    XML namespace prefix


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.4.33-13.cloudlinux.1
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Cory McIntire <cory.mcintire@webpros.com> - 7.4.33-15
changelog:
  - ZC-12614: Rolling “ea-php74” back to “2ae8a0c01d69dbc710734ff516c17a19a479fa13”: was not meant to be merged


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 7.4.33-13.cloudlinux.5
changelog:
  - EA4D-789: Security fixes
  - CVE-2024-11235: use-after-free for ??= due to incorrect live-range calculation


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.4.33-18.cloudlinux.5
changelog:
  - EA4D-797: revert to use system libxml2 lib for all platforms
  - EA4D-808: fix Provides field in debian/control to use exact versions
  - EA4D-811: remove libphp7.so from _root_httpd_moddir to fix file conflicts


author: Remi Collet <remi@remirepo.net> - 5.3.1-2
changelog:
  - add patches for PHP 8 from upstream and
    https://github.com/phpredis/phpredis/pull/1845
  - disable msgpack serializer with PHP 8


