# changelog

author: Dan Muey <daniel.muey@webpros.com> - 2.4.64-3
changelog:
  - EA-13041: Rolling “ea-apache24” back to “35b37d6c7295199c5157c68145f220d9fa61ff02”: Apache v2.4.64 broke SNI (rando 421)


author: Cory McIntire <cory.mcintire@webpros.com> - 2.4.66-1
changelog:
  - EA-13281: Update ea-apache24 from v2.4.65 to v2.4.66
  	- low: Apache HTTP Server: mod_md (ACME), unintended retry intervals (CVE-2025-55753)
  	- low: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVE-2025-58098)
  	- moderate: Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF (CVE-2025-59775)
  	- low: Apache HTTP Server: CGI environment variable override (CVE-2025-65082)
  	- moderate: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo (CVE-2025-66200)


author: Cory McIntire <cory.mcintire@webpros.com> - 2.4.67-1
changelog:
  - EA-13423: Update ea-apache24 from v2.4.66 to v2.4.67
  	- important: Apache HTTP Server: http2: double free and possible RCE on early reset (CVE-2026-23918)
  	- moderate: Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr (CVE-2026-24072)
  	- moderate: Apache HTTP Server: mod_auth_digest timing attack (CVE-2026-33006)
  	- low: Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header() (CVE-2026-28780)
  	- low: Apache HTTP Server: mod_md unrestricted OCSP response (CVE-2026-29168)
  	- low: Apache HTTP Server: mod_dav_lock indirect lock crash (CVE-2026-29169)
  	- low: Apache HTTP Server: mod_authn_socache crash (CVE-2026-33007)
  	- low: Apache HTTP Server: multiple modules HTTP response splitting (CVE-2026-33523)
  	- low: Apache HTTP Server: off-by-one OOB reads in AJP getter functions (CVE-2026-33857)
  	- low: Apache HTTP Server: mod_proxy_ajp heap buffer over-read in ajp_msg_get_string (CVE-2026-34032)
  	- low: Apache HTTP Server: mod_proxy_ajp heap over-read in ajp_parse_data() (CVE-2026-34059)


author: Cory McIntire <cory.mcintire@webpros.com> - 2.4.67-3
changelog:
  - EA-13454: Backport mod_http2 v2.0.41 fix for CVE-2026-49975 (HTTP/2 Bomb - cookie LimitRequestFields bypass)


author: Igor Savenko <bliss@cloudlinux.com> 4.0.50-5
changelog:
  - Fixed spec file (added /opt/passenger to %files section)
  - Added pre-creating dir for apache conf files in handle_module.py


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> 5.0.26-21
changelog:
  - Rebase upon passenger-5.0.26
  - Added support for DirectAdmin
  - More robust alt-mod-passenger installation routine for CPanel servers
  - Deploy pre-built binaries for non CPanel servers
    (thus no custom httpd-devel, alt-mod-passenger depends on)
  - Use pre-built ruby native support library for all CloudLinux alt-ruby versions,
    so that the library is not built on-fly per user app first invokation


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> 5.0.29-22
changelog:
  - Rebase upon passenger-5.0.29
  - Return back to Passenger 4.0 tmp/restart.txt behavour (minimal lag
    between touching app/tmp/restart.txt and app restart)
  - Fixup installation script for non-panel server


author: Vladimir Prokofev <vprokofev@cloudlinux.com> 5.0.29-26
changelog:
  - Support httpd, httpd24 and EA4 apache with same passenger
  - New passenger version 5.0.29
  - Small bug fixes


author: Vladimir Prokofev <vprokofev@cloudlinux.com> 5.0.29-27
changelog:
  - Improve checking of the building passenger native libs.
  - Bug fix usage of have_ functions to build native libs


author: Vladimir Prokofev <vprokofev@cloudlinux.com> - 5.0.29-27.2
changelog:
  - Improve checking of the building passenger native libs.
  - Bug fix usage of have_ functions to build native libs
  - Provides ea-apache24-alt_mod_passenger package name


author: Vladimir Prokofev <vprokofev@cloudlinux.com> 5.0.30-3
changelog:
  - Check configs to migrate from 4.x to 5.x Passenger
  - Restart Passenger (via httpd) to reload fresh liblve


author: Vladimir Prokofev <vprokofev@cloudlinux.com> 5.0.30-4
changelog:
  - Install Passenger into separate version folders
  - Tune simlinks to point to proper Passenger version
  - Fix permissions of PassengerInstanceRegistryDir to 755


author: Serhii Kokhan <skokhan@cloudlinux.com> - 5.1.6-1
changelog:
  - ALMODP-77: Make /var/passenger less worldwide accessible
  - ALMODP-60: Use `PASSENGER_INSTANCE_REGISTRY_DIR` instead `PASSENGER_TEMP_DIR`
  - ALMODP-81: Add conflict for package ea-ruby24-mod_passenger


author: Serhii Kokhan <skokhan@cloudlinux.com> - 5.1.11-1
changelog:
  - ALMODP-91: Arbitrary file read vulnerability in passenger
  - ALMODP-89: Made graceful reload Apache instead of restart when alt-mod-passenger install/update
  - Remove dependency from old package which obsoletes ea-apache24-alt_mod_passenger
  - ALMODP-86: Add Node.js language support for alt-mod-passenger


author: Sergey Kokhan <skokhan@cloudlinux.com> - 5.3.7-2
changelog:
  - ALMODP-112: disable nodejs handler by default
  - ALMODP-111: allow PassengerFriendlyErrorPages PassengerAppEnv passenger directives in htaccess


author: Sergey Kokhan <skokhan@cloudlinux.com> - 5.3.7-4
changelog:
  - ALMODP-121: Removed files with 1667 uid
  - ALMODP-120: fix httpd24-alt-mod-passenger spec for new httpd24-httpd


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 5.3.7-6
changelog:
  - ALMODP-134: Fix write application custom passenger log to user's tmp under cagefs
  - ALMODP-135: Deleted writing warning to main apache log when using user's custom log


author: Sergey Kokhan <skokhan@cloudlinux.com> - 5.3.7-14
changelog:
  - ALMODP-143: httpd24-alt-mod-passenger installation paths for mod_passenger.so and mod_passenger.conf changed


author: S. Kurt Newman <kurt.newman@cpanel.net> - 2.3.9-7
changelog:
  - General cleanup (EA-5395)
  - Cleans up run/mod_fcgid directory when package is uninstalled (EA-5594)
  - Switch to rpm macros


author: Igor Seletskiy <iseletsk@piter.seletskiy.com>
changelog:
  - Ability to provide which handlers to treat as suexec, and which to treat regularly <commit: 37ad6a8d6dafd9486217f60e369c530c17510ac6>


author: Igor Seletskiy <iseletsk@piter.seletskiy.com>
changelog:
  - Fixed issue when mod_hostinglimits intercepts request already in lve (when php is done via cgi) <commit: abccd6a8276eefca2e50dcf03cfb0519fe3b6f26>


author: Alexey Berezhok <alexey_com@ukr.net>
changelog:
  - add mode -m 644 to spec file and add php-script to modhostinglimits.conf <commit: 6bf688d72a68442b2886926fba8cb19ba6a10fc7>


author: Igor Seletskiy <iseletsk@piter.seletskiy.com>
changelog:
  - Added directories/confgis to make sure mod_hostinglimits compiles under directadmin <commit: 242e320b83b167435f2b2dccb7c4d3ca045e3a42>


author: Alexey Berezhok <alexey_com@ukr.net>
changelog:
  - fix spec file's string with liblve to lve-devel. liblve - for future releases <commit: fb10d65ba6364b6ce78e70e3decbf8200b8a0be2>


author: Igor Seletskiy <iseletsk@piter.seletskiy.com>
changelog:
  - moved p_cookie to be taken from request_config, making module MPM Worker safe <commit: fdab876e8fb52f0f3a21f9fa836cc411b9d4a392>


author: Igor Seletskiy <iseletsk@piter.seletskiy.com>
changelog:
  - Merge branch 'master' of gitosis@pylesos.interdon.net:mod_hostinglimits <commit: f3b7c8df2280fa81b54c33dc53bf6d46f7cf4caa>


author: Alexey Berezhok <alexey_com@ukr.net>
changelog:
  - Fix bug when p_cookie is not installed process was fall down <commit: 44668ecf8599ee39ab8f21ae632d0e4514f67192>


author: Alexey Berezhok <alexey_com@ukr.net>
changelog:
  - Add private thread variable p-cookie instead mutex <commit: a3d7f50a59f2f94b463edfdf76f67c4a5235cfd8>


author: Alexey Berezhok <alexey_com@ukr.net>
changelog:
  - Fix bug with User and Group params. I can get it bu using server record <commit: 54be580ac5db55913a32a5cf8fb01981a671ef84>


author: Anton Volkov <avolkov@cloudlinux.com> 0.7-1
changelog:
  - [#Feature 189] AllowedHandlers and DenyHandlers directives regex support is added
    - [#Feature 191] DenyHandlers directive support is added
    - Allow to serve content on LVE re-entry(apache 1.3)


author: Alexey Berezhok <alexey_com@ukr.net> 0.7-1
changelog:
  - Add new spec file 3 rpm in 1 spec file
    - Add fix in *.cmake file for building under H-Sphere 3.1


author: Anton Volkov <avolkov@cloudlinux.com> 0.7-2
changelog:
  - Added support for new LVEErrorCode directive
    - Default LVEErrorCode is changed from 503 to 508, default error 508 page is added in module source
    - Bug fix: checking whether we are already in LVE (errno should be EPERM, not -EALREADY)
    - Bug fix: logging "already in LVE" error in module for Apache 1.3


author: Alexey Berezhok <alexey_com@ukr.net> 0.7-8
changelog:
  - Restored leave hendler                                                                                                                                    
  - Removed request pool data storing                                                                                                                         
  - Disable empty host debugging
  - Added new directive LVESitesDebug                                                                                                                         
  - Re-entry procedure restored                                                                                                                               
  - Optimized leave handler                                                                                                                                   
  - Optimized work with child pools
  - Reset errno on module initializtion
  - Repaired lve available check
  - Added support mod_ruid2                                                                                                                                   
  - Added new derctive LVEUser                                                                                                   
  - Added support of apache-mpm-itk


author: Alexey Berezhok <alexey_com@ukr.net> 0.7-15
changelog:
  - Added support new apr                                                                                                                                     
  - Removed h-sphere support. No more need


author: Alexey Berezhok <alexey_com@ukr.net> 0.8-1
changelog:
  - Added LVERetryAfter: send RetryAfter header
  - Added LVEParseMode: there are three modes of working(CONF, PATH, OWNER)
  - Added LVEPathRegexp: regexp expression for username extracting from path(PATH mode)
  - Added LVEHeaderName: not supported yet
  - Added URL with error description in log


author: Alexey Berezhok <alexey_com@ukr.net> 1.0-5
changelog:
  - Added LVEUids debug
  - Fixed bug with mod_userdir + mod_hostinglimits
  - Renew lve api for apache 1.3


author: Stefan Mortensen <stefan.mortensen@atomia.com>, Mikhail Zhbankov <mzhbankov@cloudlinux.com> 1.0-26
changelog:
  - Fixed issue where cfg->path_regex was never being set when setting a custom path with LVEPathRegexp causing the default to always be used
  - AAP-57: mod_hostinglimits not increases EP in cgi mode (but process is in LVE)


author: Eugen Vodilov <evodilov@cloudlinux.com> - 1.0-30
changelog:
  - AAP-142: avoid lve_leave using filters
  - AAP-151: add EP limit hiting when EP is reached max value


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> - 1.0-37.1
changelog:
  - AAP-273: expand the range of LVEErrorCodes
  - AAP-253: spec and cmake redesigned for new httpd24 build
  - AAP-241: Update Copyright for mod_hostinglimits project
  - AAP-244: Fix cmakefiles for httpd24-mod_hostinglimits


author: Aleksandr Demeshko <ademeshko@cloudlinux.com> Nikolay Petukhov <npetukhvov@cloulinux.com> - 1.0-40
changelog:
  - AAP-510: log level changed to WARN for limited requests
  - AAP-493: Improved log output
  - AAP-508: Allowed AllowedHandlers and DenyHandlers directives inside Directory, Location and Files contexts


author: Nika Keshelava <nkeshelava@cloudlinux.com> - 1.0-46
changelog:
  - CLOS-3754: fix SIGSEGV in process_lve_error() when mod_brotli is loaded
  - CLOS-4441: Maintenance update
  - CLOS-4585: Maintenance update


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-15
changelog:
  - suPHP_UserGroup processing
  - fixed cPanel's install script
  - extended debug_enabled mode fix
  - LVE entering removed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-17
changelog:
  - Server config merging
  - Default value of lsapi_pgrp_max_idle is changed
  - Handler to Backend dir is moved into the library


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-39
changelog:
  - Added secret file installation
  - Fixed hook for patching cPanel templates
  - sulsphp signs
  - sulsphp parent check


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-42
changelog:
  - Using Apache or apr random function instead of /dev/random
  - Processing internal redirects
  - Spec fixes
  - Fixed installation scripts


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-51
changelog:
  - Error 404 in the case of script absense
  - Script owner and permission checks
  - Full support for lsapi_phprc


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-53
changelog:
  - Added lsapi_target_perm config parameter
  - Fixed NULL server-var bug
  - Logging backend fatal error log
  - Fixed DA directory name


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-54
changelog:
  - Added lsapi_uid_gid config parameter
  - Added lsapi_use_default_uid config parameter
  - uid/gid params moved to dir config


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-58
changelog:
  - Hook removed
  - Defaults for lsapi_backend_connect_timeout and lsapi_backend_connect_tries changed
  - lsapi_user_group added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-68
changelog:
  - Timeout for backend poll added
  - Backend poll redesign
  - PHP ENV modify_type fix
  - lsapi_hostname_on_debug parameter added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-69
changelog:
  - Delayed invoke mode added
  - read/write/poll backend refined
  - Log messages on error conditions added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-71
changelog:
  - TMPDIR, TEMP and TMP added into safe env var list
  - Dump headers always option is added into config
  - Debug data exchange config option added
  - Dealing with REDIRECT_STATUS added (MODLS-11 fix)
  - Fixed DA install script
  - Resending request if lsphp crash or reset connection added (MODLS-12 fix)
  - Send 503 code in the case of lsphp killing (MODLS-13 fix)


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-77
changelog:
  - lsapi_mutex_mech option added
  - send_data simplified
  - cagefs mp fix
  - audit fixes
  - 401 redirect fix
  - 503 response when lsphp is killed
  - REDIRECT_STATUS fix
  - TMPDIR, TEMP and TMP added into safe env var list


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-84
changelog:
  - RPM spec fix
  - Added mod_lsapi rebuild into after_apache_make_install hook
  - 302 Moved Temporarily instead of 302 Found
  - Chrome 302 fix


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-90
changelog:
  - lsapi_do_request redesign
  - lsphp response code used
  - PHP error pages displayed
  - Fatal error log processed correctly
  - Fix 500 Internal server error on 200 Ok page


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-91
changelog:
  - lsapi_backend_children changed to 80
  - Starter pid log output added
  - sulsphp_log location for DA changed
  - selfstarter mode always enabled
  - Log request_rec on send_request error
  - Some advices to error log added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-98
changelog:
  - Default value for lsapi_use_default_uid changed to On
  - nobody and apache added as exception to sulsphp


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-1
changelog:
  - Add disabling php_* directives processing
  - sulsphp moved into library
  - ACCEPT_NOTIFY mode implemented
  - Deprecated methods removed
  - Connection pool mode implemented
  - lsapi_backend_max_idle and lsapi_backend_max_reqs parameters added
  - Default lsapi_socket_path changed
  - Added build lsphp with custom php sources location
  - Added hook for autobuild lsphp on easyapach rebuild
  - Creation of subdirectories for socket dir added
  - Fix for custom path lsphp build
  - Old mod_lsapi src.rpm generated


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-4
changelog:
  - use_suexec option implemented
  - lsapi_check_document_root option implemented
  - Fix mod_lsapi release number in rpm spec
  - Fix path of php source detection on cPanel
  - Fixed php.ini for correct php work on cPanel
  - Precise Requires: tags in rpm specs
  - Fix for compilation flags for sulsphp in CMakeLists


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-12
changelog:
  - lsapi_backend_accept_notify related bug fix
  - mod_lsapi archive for OBS mode added
  - EA4 package scripts added
  - X-Accel-Buffering: no header support added
  - gdb and lsof removed from mod_lsapi rpm deps
  - Default value for lsapi_accept_notify option changed to On


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-15
changelog:
  - MODLS61: Server-Sent Events support added
  - lsapi_paranoid option added
  - MODLS21: Auto value for lsapi_phprc option added
  - MODLS62: lsapi_max_connection option implemented


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-16
changelog:
  - Merging with_connection_pool CRIU branch
  - Fix for OBS
  - MODLS70: X-Powered-By related fix
  - secret file size fix
  - TMP and TEMP env vars added into default config


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-17
changelog:
  - backend_accept_notify fix
  - MODLS73: Custom response code support
  - MODLS71: Simpla authorization fix
  - Fixed restore global mod_lsapi after easyapache rebuilding


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-20
changelog:
  - /dev/urandom used to generate secret file
  - Default value for lsapi_backend_children changed to 120
  - Default socket path changed to /var/run/mod_lsapi
  - Creating default socket path on start
  - Coverity issues small fixes
  - Fixes for EA4
  - Add to file /etc/container/php.handler handlers for EA4


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-21
changelog:
  - 'Requires:' tag changed to liblsapi only
  - Added force update after lsphp rebuild
  - MODLS98: /var/run/mod_lsapi directory creation fix
  - MODLS102: TMPDIR var in default config
  - Removed dependency on CageFS
  - MODLS100: cagefs mount point removed
  - MODLS90: lsapi_backend_use_own_log option added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-22
changelog:
  - MODLS-94: Error in case of setup mod_lsapi on CL5 without any panel
  - MODLS-107: REDIRECT_STATUS message supressed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-24
changelog:
  - MODLS-104 lsapi_resend_if_crashed option added
  - MODLS-108: domain name added into lsphp socket name
  - MODLS-109 Fix POST >100K fails when body length is omitted
  - adaptive_mmap() in lscapi_send_request()
  - MODLS-105 lscapi_send_request() refactoring
  - MODLS-106: Fixup for rare backup connection fails


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-26
changelog:
  - MODLS-125: Do not allow to process .php.disabled extensions
  - MODLS-126: switch_mod_lsapi on 7.2 fix


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-27
changelog:
  - MODLS-130: Full info in sulsphp error messages
  - MODLS-132: Fix wrong processing of lsapi.conf by switch_mod_lsapi


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-29
changelog:
  - Fixes for switch utility for EA4
  - MODLS-128: switch_lsapi script fix
  - MODLS-153: Add more log info in case of entering jail error
  - MODLS-151: Dependencies from older alt-php packages removed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-32
changelog:
  - Fix in script for CL 7.2 version
  - MODLS-155: default value of mutex mechamism changed to posixmem
  - MODLS-156: LSAPIPath option support added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-33
changelog:
  - MODLS-169: Don't flood /tmp with send_request() buf artifacts
  - MODLS-170: Config option for alternate tmp directory
  - lscapi_reset_internal_error_state definition moved to lscapi.h


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-9
changelog:
  - MODLS-231: Fix HTTPOXY vulnerability
  - MODLS-232: Removing of mod_ruid2 configs added to EA3 rebuilding hook
  - MODLS-230: connection pool mode switched to on by default
  - poll mask changed in lscapi_is_socket_closed


author: Alexey Berezhok <aberezhok@cloudlinux.com> 1.0-10
changelog:
  - MODLS-227: Errors during execute cloudlinux_ea3_to_ea4 with --mod_lsapi 
  - MODLS-226: Lsapi script should have verifying of cagefs install


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-11
changelog:
  - MODLS-234: Fix switch_mod_lsapi for PLESK systems
  - AAP-104: Improve communication between mod_lsapi worker and starter


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-12
changelog:
  - MODLS-240: event mask for poll in waiting output from lsphp changed
  - AAP-110: unnecessary restart of Apache during EA3 build removed
  - MODLS-238: LVE_NO_MAXENTER flag added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-15
changelog:
  - MODLS-252: replacement of native php avoided
  - Filtering of HTTP_AUTHORIZATION and HTTP_PROXY_AUTHORIZATION removed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-16
changelog:
  - connection pool mode switched to off by default
  - MODLS-256: fixing of broken lsapi.conf on EA4 added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-17
changelog:
  - MODLS-248: logrotate config for sulsphp_log added
  - MODLS-257: Scriptlet automation --setup and --uninstall added for EA4
  - MODLS-259: Possibility to set PHPRC via SetEnv added
  - MODLS-260: Fix switch_mod_lsapi for CL5


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-18
changelog:
  - MODLS-254: Fix lsphp path in /etc/container/php.handler added
  - MODLS-262: lsapi_per_user option added
  - AAP-106: Fix to standard behavour of PHPRC on EA4 php added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-19
changelog:
  - MODLS-272: Possibility to pass env vars to safe env added
  - MODLS-271: correct /usr/local/bin/lsphp symlink on PLESK
  - MODLS-266: Config option management fixed
  - MODLS-268: rewriting of lsapi config file on EA4 fixed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-21
changelog:
  - MODLS-261: Dependency from alt-php56 removed from EA4 mod_lsapi rpm
  - MODLS-249: Fix for full logging of backend messages
  - MODLS-276: switch_mod_lsapi bug fixed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-22
changelog:
  - MODLS-281: Fix crashing Apache on DA servers
  - MODLS-274: user.ini support added to mod_lsapi-1.0
  - MODLS-277: Make sulsphp work with 500+ users in group
  - MODLS-279: mod_lsapi gets disabled after some time post enabling (fcgid mod, cpanel)
  - MODLS-273: Maximum path length for PHPRC increased


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-24
changelog:
  - Fix work in backend_accept_notify Off mode with multiple logs from backend
  - MODLS-275: check-php command ported to 1.0 branch


author:
  Alexandr Demeshko <ademeshko@cloudlinux.com>, Ruslan Kuprieiev <rkuprieiev@cloudlinux.com>, Alexey Berezhok <alexey.berezhok@cloudlinux.com> 1.1-2

changelog:
  - MODLS-269: Make lsphp working with PHP versions selected with MultiPHP on EA4 when SuPHP enabled
  - MODLS-308: LSAPI protocol logging added
  - MODLS-333: Drop criu system service and use something similar internally. CRIU as a system service is not recommended for use
  - MODLS-332: Add some way to trigger images cleanup
  - MODLS-331: Change criu images perms to 0600, as existing 0644 might not be secure enough
  - MODLS-330: Hide all debug and extra messages. Activate them only with specific parameter
  - MODLS-229: Make lsphp wait for dump to end, so it can detect when it's restored from images and cleanup its dead children
  - Added librt for CloudLinux 6


author:
  Alexandr Demeshko <ademeshko@cloudlinux.com>, Serhii Kokhan <skokhan@cloudlinux.com>, Alexey Berezhok <alexey.berezhok@cloudlinux.com> 1.1-3

changelog:
  - MODLS-344: Plesk 17.0.17 version does not read /usr/local/psa/admin/conf/templates/custom/domain/domainVirtualHost.php.
  - MODLS-311: CL7 only. First start of lsphp after reboot takes a lot of time(about 7 seconds longer than suphp). Try to make so-lib cache before first usage of lsphp
  - MODLS-339: Make global flag for signaling of removing all images for CRIU(it can bee needed when php will be updated)
  - MODLS-345: Add creation of dump on lsphp stopping
  - MODLS-359: Check if /etc/container/php.handler updates properly
  - MODLS-364: mod_lsapi with criu don't create criu imgs in directory which is set by lsapi_criu_imgs_dir_path option


author: Alexandr Demeshko <ademeshko@cloudlinux.com>, Serhii Kokhan <skokhan@cloudlinux.com> 1.1-4
changelog:
  - MODLS-347: Remove LSCAPI_CRIU_SYNC_FD from the output of lsphp (phpinfo). Because it is service info
  - MODLS-367: Detect when CRIU is stopped and lsapi_criu is On and write message to apache log: Start CRIU. Service is stopped.
  - MODLS-193: Support custom php.ini added
  - MODLS-370: Add to CRIU, creation images for different virtual host under one user
  - MODLS-366: Improper option scopes fixed
  - MODLS-376: Fix PHP Selector on Plesk + mod_lsapi
  - MODLS-339: Added description of lsapi_reset_criu_on_apache_restart flag to lsapi.conf file
  - MODLS-378: sulsphp_log permissions changed to default Apache ones


author: Alexandr Demeshko <ademeshko@cloudlinux.com>, Serhii Kokhan <skokhan@cloudlinux.com> 1.1-5
changelog:
  - MODLS-388: destroy_lve symbol lookup bug fixed
  - MODLS-389: starter lock mechanism changed to fcntl
  - MODLS-384: Conflict with ea-apache24 added to mod_lsapi spec
  - MODLS-379: /usr/selector and ea-php locations for lsphp added into csf rules
  - MODLS-374: Cache of spawn_info_t structure sent on every lsphp starting for domain" into mod_lsapi-1.0.criu


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-9
changelog:
  - MODLS-394: starter mutex switched to PTHREAD mech to avoid deadlocks on MPM Event
  - MODLS-340: Corrected CRIU functions
  - MODLS-405: DocRoot special value is added to lsapi_phprc option


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-10
changelog:
  - MODLS-368: Add mod_lsapi handler to EA4 PHP handlers
  - MODLS-399: Fetch litespeed sources over https for beta
  - MODLS-408: Add PHP71 handler
  - MODLS-391: Buffer temporary file completely before passing it to backend PHP process


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-11
changelog:
  - MODLS-401: Add dynamic tuning of lsapi_backend_children parameter
  - MODLS-410: Priority of php_value from httpd.conf lowered to PERDIR


author: Serhii Kokhan <skokhan@cloudlinux.com> 1.1-12
changelog:
  - MODLS-419: Make script for switching lsapi from old mechanism(--enable-global, --enable-domain) to new mechanism(lsapi via web-interface of cPanel)


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-13
changelog:
  - MODLS-423: php_value htaccess flag value changed
  - MODLS-422: Add ability to disable lsapi while it is enabled globally EA3
  - MODLS-424: uninstall does not work properly


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-14
changelog:
  - MODLS-430: Add lsphp handlers to users Plesk panel correctly
  - MODLS-431: lsapi_output_buffering option added
  - MODLS-414: env var for lsphp log prefix added
  - MODLS-417: Backend log changed to own file on EA4
  - MODLS-368: Removed suphp detection
  - Changed method of suphp detection


author: Serhii Kokhan <skokhan@cloudlinux.com> 1.1-15
changelog:
  - MODLS-436: Add force option to switch_mod_lsapi --setup
  - MODLS-429: switch_mod_lsapi --build-native-lsphp is not executed randomly after upcp on EA3
  - MODLS-433: New mechanism lsapi and web-interface of cPanel. Proposed by cPanel team


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-16
changelog:
  - MODLS-403: Check for Cloudlinux added to liblsapi
  - MODLS-434: Handler value was dropped after update
  - MODLS-435: Conflict with mpm_itk added to EA4 mod_lsapi
  - MODLS-433: New mechanism lsapi and web-interface of cPanel
  - Added /opt/cloudlinux as safe path
  - Fix httpd24 CL7 build


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-17
changelog:
  - MODLS-443: Hotfix: add setup-light command for cleaning all garbage in htaccess wich bring by previous versions
  - MODLS-442: Configure uninstall/update mod_lsapi with Plesk panel
  - MODLS-440: looking for user.ini in home dir
  - MODLS-400: DA script changed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-20
changelog:
  - MODLS-445: CRIU messaging changed
  - MODLS-456: Added handlers for php 7.2 for cPanel EA4 and Plesk


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-21
changelog:
  - MODLS-452: Fix destroying of starter mutex on worker and event MPMs
  - MODLS-457: PWD var added into safe environment as cwd of backend process
  - MODLS-464: Max size of response header package fixed
  - MODLS-463: Add application/x-httpd-ea-php72___lsphp /opt/cpanel/ea-php72/root/usr/bin/lsphp and application/x-httpd-ea-php72-lsphp /opt/cpanel/ea-php72/root/usr/bin/lsphp
  - MODLS-460: Add ability to set lsapi_backend_children manually


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-22
changelog:
  - MODLS-466: lsapi_backend_semtimedwait option switched on by default
  - MODLS-466: lsapi-cache service improved
  - MODLS-466: lsapi-cache service for CL6 implemented
  - MODLS-468: criu messaging changed
  - MODLS-476: Add corresponding to criu messages into sulsphp_log
  - MODLS-475: Cleanup criu images on dump error
  - AAP-189: ea-apache24-mod_suphp-0.7.2-21 package installation flush php handlers to suphp
  - MODLS-470: Reset all criu images on update criu-lve and alt-phpXY


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-23
changelog:
  - MODLS-479: Make correct output of the totBytesRead and bodyLen values
  - MODLS-478: Prefix lsapi errors with timestamps
  - MODLS-472: unlimit core file size when BACKEND_COREDUMP on


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-24
changelog:
  - MODLS-483: Fix premature mutex destroying on MPM Event
  - MODLS-482: Refactor CRIU patch for PHP
  - MODLS-472: unlimit core file size on CL6


author: Serhii Kokhan <skokhan@cloudlinux.com> 1.1-25
changelog:
  - MODLS-494: implement ~/mod_lsapi_reset_me flag for removing all CRUI images for all domains of user
  - dependency from alt-libxml2 removed from ea-apache24-mod_lsapi


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-29
changelog:
  - MODLS-538: Alignment issue fixed
  - MODLS-531: Added check if criu images exist on restore request
  - MODLS-532: lsapi_disable_reject_mode option is added
  - MODLS-528: reopen sulsphp_log to exclude too big FD number for criu
  - MODLS-520: Added new lsapi_avoid_zombies config
  - MODLS-491: Avoid worker's child to accept the connection
  - MODLS-491: Avoid reading/writing stale data from/to the lsphp socket
  - MODLS-527: starter logic is improved
  - MODLS-525: httpd criu dumper permissions changed
  - MODLS-519: Option to disable PWD var added


author:
  Alexandr Demeshko <ademeshko@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-30

changelog:
  - MODLS-551: statistics for Plesk via API only; structure reinvented for EA4
  - MODLS-549: Added dump configs lsapi_criu, lsapi_with_connection_pool, lsapi_per_user
  - MODLS-549: mod_lsapi stat for EA4 (v.1)
  - MODLS-441: http_keep_http200 option added
  - MODLS-533: Hook for Plesk update added
  - MODLS-548: Suppress unrelevant warning messages on Apache restart


changelog:
  - switch_mod_lsapi --stat option added
  - MODLS-560: Installation of mod_lsapi package on DA added

author:
  Alexandr Demeshko <ademeshko@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-31


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-32
changelog:
  - MODLS-574: Started logics improvement
  - MODLS-573: add support alt-php7.3 for mod_lsapi (plesk) and ea-apache24-mod_lsapi
  - MODLS-565: lsapi_poll_timeout default-value 300


author:
  Sergey Kokhan <skokhan@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-33

changelog:
  - MODLS-590: Fixed stack overflow lscapi_do_request
  - MODLS-582: Update Copyright for mod_lsapi project
  - MODLS-589: fix lsapi_terminate_backends_on_exit and lsapi_reset_criu_on_apache_restart directives
  - MODLS-584: semtimedwait improvement
  - MODLS-580: stat support added for DA without mod_lsapi rpm
  - MODLS-481: fix stuck when bodyLen is wrong
  - MODLS-579: Remove LVE support from cpanel mod_lsapi
  - Fix exception in case if there are no liblsapi installed
  - MODLS-576: added absolute path for service util


author:
  Daria Kavchuk <dkavchuk@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-34

changelog:
  - MODLS-608: removed non-ascii symbol in copyright
  - MODLS-606: Fix lsapi_poll_timeout functionality
  - MODLS-600: fix mod_lsapi removal sets handler to none
  - MODLS-571: add support for httpd24-mod_lsapi usage statistics
  - MODLS-598: Fix permissions on config files
  - MODLS-587, MODLS-594: selector usage statistics added
  - MODLS-588: cpanel_mod_lsapi: put all of liblsapi's files into /opt/cpanel/ea-liblsapi/


author: Daria Kavchuk <dkavchuk@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-35
changelog:
  - Fixed statistics exceptions flow
  - MODLS-615: ea-apache24-mod_lsapi epoch bumped
  - MODLS-615: liblsapi confilct with ea-liblsapi added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-36
changelog:
  - MODLS-618: liblsapi vs ea-liblsapi conflict fixed
  - MODLS-619: Requires tag added for python related pkgs


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-37
changelog:
  - MODLS-616: Ensure existence of directory for lsapi sockets in /var/run
  - MODLS-621: Add a configuration option (lsapi_use_req_hostname) that controls how virtualhost name is picked
  - AAP-253: spec and cmake files redesigned for new httpd24 build


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-38
changelog:
  - MODLS-577: Log changed for errors produced by http filter
  - AAP-243: Sentry: create a mechanism to save errors from mod_lsapi
  - MODLS-644: added ea-php73 lsapi handler
  - Added troubleshooting link into log for rejected request


author:
  Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> 1.1-39

changelog:
  - MODLS-638: Clearing of systemd cgroup for lsphp added
  - MODLS-638: MODLS-481 reverted
  - MODLS-641: Build scripts redesigned
  - MODLS-654: CMakeCache deleted on make clean
  - AAP-243: Disable lsapi_sentry by default
  - MODLS-653: DA spec file added
  - MODLS-655: fix unexpected statistics output


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-40
changelog:
  - MODLS-661: Make possibility criu work on CL7h
  - MODLS-638: During graceful restart lsphp process are killed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-42
changelog:
  - MODLS-679: fixed race condition is dump req info
  - MODLS-674: liblsapi receive response header interface redesigned
  - MODLS-670: ElasticAPM support redesigned
  - MODLS-665: added sulsphp_log logfile location directive
  - MODLS-656: unifying form of errors for sentry


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kozhekin <skozhekin@cloudlinux.com> 1.1-44
changelog:
  - MODLS-691: Elastic APM dump request info fixed
  - MODLS-689: Support for lsapi_backend_pgrp_max_reqs and lsapi_backend_pgrp_max_crashes added
  - MODLS-530: benchmark script added
  - MODLS-684: Fix Plesk tests (issue with handlers on both platforms)


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> 1.1-45
changelog:
  - MODLS-692: connection pool mode updated
  - MODLS-702: Apache restart added to mod_lsapi update
  - MODLS-703: rpm -q from mod_lsapi_stat removed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-46
changelog:
  - MODLS-723: proper request body length for 2G+ files
  - MODLS-722: clean shutdown support for LSAPI 7.6 added
  - MODLS-708: da_mod_lsapi installation added into da_cb_install script


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-47
changelog:
  - MODLS-727: Removed /var/cpanel/conf/apache/main usage as it was removed in cPanel
  - alt-php74 support added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-50
changelog:
  - MODLS-745: 1 second Apache restart condition detection added to starter
  - MODLS-746: Fix yum command string for CL8 stable in da_cb_install
  - MODLS-735: lsphp patch updated to to delete criu imgs when lsapi_backend_pgrp_max_crashes triggered
  - MODLS-737: DA hook script modified for CL8 and py3


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-51
changelog:
  - MODLS-789: rpm file integrity check added into da_cb_install
  - MODLS-760: Plesk removing hook fixed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-52
changelog:
  - MODLS-794: added no strict mode for configparser in stat utils
  - MODLS-800: Log level for backend PHP Notices changed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-53
changelog:
  - mod_lsapi changed for Litespeed SAPI 7.7
  - MODLS-811: Apache version detection fixed on update mod_lsapi


author:
  Sergey Kozhekin <skozhekin@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-56

changelog:
  - MODLS-806: Dynamic lsapi_set_env added
  - MODLS-859: Added CRIU support to httpd24-mod_lsapi
  - MODLS-851: CL license updated


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-57
changelog:
  - MODLS-878: Custom control panel integration improved for src.rpm
  - MODLS-877: Added support of alt-php81


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Hasan Aliev <haliev@cloudlinux.com> 1.1-60
changelog:
  - MODLS-905: Add possibility to work with switch_mod_lsapi to control panel integration
  - MODLS-916: Trigger scriptlet creates /usr/local/bin/lsphp as symlink


author: Nikolay Petukhov <npetukhov@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-62
changelog:
  - MODLS-935: Fixed malformed http response caused by wrong http header
  - MODLS-940: Added oom score adjustment for lsphp processes


author: Nikolay Petukhov <npetukhov@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-63
changelog:
  - MODLS-952: Fixed the bug added when solving MODLS-935
  - CRIU support disabled on CL9 due to MODLS-955


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-64
changelog:
  - MODLS-946: lsapi_backend_use_own_log option context fixed
  - MODLS-956: liblsapi dependency made strict for mod_lsapi packages
  - MODLS-959: HTTP output filter error processing changed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-65
changelog:
  - MODLS-963: ea-php82 handler added
  - MODLS-962: DA installation script modified to be called without parameters


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-73
changelog:
  - CLOS-2334: Minor mod_lsapi scripts corrections
  - CLOS-2348: Execute condition changed in switch_mod_lsapi script


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-75
changelog:
  - CLOS-2832: AlmaLinux support added
  - CLOS-2818: Changed requirement from alt-php56 to alt-php81
  - CLOS-2860: Added lsapi_get_status_line declaration


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-77
changelog:
  - CLOS-2951: Add support of alt-php 5.2-5.5 for Alma
  - CLOS-2904: Ignore errors in blacklisted config files


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-78
changelog:
  - CLOS-3055: Restore CRIU support in mod_lsapi DA tarballs
  - CLOS-3007: Add PHP 8.4 support as well as support of future PHP versions
  - CLOS-3007: Add heuristic to resolve unlisted PHP handlers
  - CLOS-3043: Add support of Ubuntu 22


author:
  Timur Averianov <taverianov@cloudlinux.com> Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 1.1-86

changelog:
  - MAXWS-785: Fix backend termination script hanging in the background when there were too many processes
  - CLOS-3499: Update package to be compatible with CloudLinux 10


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> Timur Averianov <taverianov@cloudlinux.com> 1.1-87

changelog:
  - CLOS-3355: Set the docroot and domain information in the env before spawning lsphp
  - CLOS-3574: Use LSPHPRC instead of PHPRC if ea-php is version 8.4 and higher
  - CLOS-3646: Support RLIMITs


author: Nika Keshelava <nkeshelava@cloudlinux.com>, Serhii Kokhan <skokhan@cloudlinux.com> 1.1-93
changelog:
  - CLOS-1655: Add CRIU support for CL9 and CL10
  - CLOS-4290: Minor fixes in request parsing and configuration scripts


changelog: - Initial MAx Cache implementation for CloudLinux
author:
  Danila Vershinin <dvershinin@cloudlinux.com>, Sandro Kalatozishvili <skalatozishvili@cloudlinux.com>, Sergey Kokhan <skokhan@cloudlinux.com> 1.0.0-1


changelog: - Initial MaxCache implementation for CloudLinux
author:
  Danila Vershinin <dvershinin@cloudlinux.com>, Sandro Kalatozishvili <skalatozishvili@cloudlinux.com>, Sergey Kokhan <skokhan@cloudlinux.com> - 1.0.0-1


author: Serhii Kokhan <skokhan@cloudlinux.com> - 1.1.0-1
changelog:
  - MAXWS-1043: Remove htcache-watchd dependency; use per-request stat() polling (RevalidateInterval=0)
  - MAXWS-1042: Rename MaxCacheHTCache* directives to MaxCacheHtaccess*; old names kept as deprecated aliases
  - MAXWS-1042: Rename htcache-status handler to maxcache-htaccess-status; old name kept as deprecated alias
  - MAXWS-1042: Rename config file maxcache_htcache.conf to maxcache_htaccess.conf with migration


author: Cory McIntire <cory@cpanel.net> - 2.9.7-1
changelog:
  - EA-11134: Update mod_security2 from v2.9.6 to v2.9.7
  - Security impacting issues
      Fix: FILES_TMP_CONTENT may sometimes lack complete content
      [Issue #2857 - gieltje, @airween, @dune73, @martinhsv]


author: Cory McIntire <cory.mcintire@webpros.com> - 2.9.8-1
changelog:
  - EA-12853: Update ea-apache24-mod_security2 from v2.9.7 to v2.9.8
  - Remove 2 patches that were added upstream.
  	- 0003-Import-some-memory-leak-fixes-for-Mod-Security-2.9.x.patch
  	- 0004-Allow-Lua-5.4.patch
  - Add new patch for re.c to allow it to build on Ubuntu
  - Add new patch for tests on Ubuntu 20


author: Dan Muey <daniel.muey@webpros.com> - 2.9.9-1
changelog:
  - EA-12885: Update ea-apache24-mod_security2 from v2.9.8 to v2.9.9
  - Possible DoS vulnerability: CVE-2025-47947


author: Dan Muey <daniel.muey@webpros.com> - 2.9.10-1
changelog:
  - ZC-12886: Update ea-apache24-mod_security2 from v2.9.9 to v2.9.10
  - DoS vulnerability: CVE-2025-48866


author: Cory McIntire <cory.mcintire@webpros.com> - 2.9.11-1
changelog:
  - EA-12994: Update ea-apache24-mod_security2 from v2.9.10 to v2.9.11
  - prevent segmentation fault if the XML node is empty: CVE-2025-52891


author: Dan Muey <daniel.muey@webpros.com> - 2.9.12-1
changelog:
  - EA-13061: Update ea-apache24-mod_security2 from v2.9.11 to v2.9.12
  - fix: Improper error handling CVE 2025-54571


author: Jared Wright <jared.wright@webpros.com> - 1.0-123
changelog:
  - EA4-249: Add target-os package rename mapping support to ea_current_to_profile
  - EA4-249: Add ignore_deps support to package rename mappings


author: Cory McIntire <cory@cpanel.net> - 8.11.0-1
changelog:
  - EA-12523: Update libcurl from v8.10.1 to v8.11.0
  - CVE-2024-9681: HSTS subdomain overwrites parent cache entry


author: Cory McIntire <cory@cpanel.net> - 8.11.1-1
changelog:
  - EA-12607: Update ea-libcurl from v8.11.0 to v8.11.1
  - CVE-2024-11053: netrc and redirect credential leak


author: Cory McIntire <cory.mcintire@webpros.com> - 8.12.0-1
changelog:
  - EA-12678: Update ea-libcurl from v8.11.1 to v8.12.0
  - CVE-2025-0167 / CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
  - CVE-2025-0665 / CWE-1341: Multiple Releases of Same Resource or Handle
  - CVE-2025-0725 / CWE-680: Integer Overflow to Buffer Overflow


author: Cory McIntire <cory.mcintire@webpros.com> - 8.14.0-1
changelog:
  - EA-12899: Update ea-libcurl from v8.12.1 to v8.14.0
  - CVE-2025-5025: No QUIC certificate pinning with wolfSSL
  - CVE-2025-4947: QUIC certificate check skip with wolfSSL


author: Cory McIntire <cory@cpanel.net> - 8.17.0-3
changelog:
  - EA-13370: Security: backport CVE-2026-3805 (SMB use-after-free, Medium)
  - EA-13370: Security: backport CVE-2026-3783 (bearer token leak via netrc+redirect, Medium)
  - EA-13370: Security: backport CVE-2026-1965 (HTTP Negotiate connection reuse, Medium)
  - EA-13370: Security: backport CVE-2026-3784 (proxy credential reuse, Low)
  - EA-13370: Security: backport MQTT too-big-message-check (HackerOne 3508500)
  - EA-13370: Security: backport TFTP filename length check (HackerOne 3508321)


author: Cory McIntire <cory@cpanel.net> - 8.17.0-4
changelog:
  - EA-13421: Security: backport CVE-2026-5545 (HTTP Negotiate connection reuse auth check, Medium)
  - EA-13421: Security: backport CVE-2026-4873 (non-TLS STARTTLS connection reuse bypass, Low)
  - EA-13421: Security: backport CVE-2026-7168 (proxy Digest auth state leak on proxy switch, Medium)
  - EA-13421: Security: backport CVE-2026-6253 (proxy credentials not cleared on port/scheme change, Medium)
  - EA-13421: Security: backport CVE-2026-6276 (stale cookiehost on handle reuse, Low)
  - EA-13421: Security: backport CVE-2026-6429 (netrc credential leak via redirect, Medium)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.17.0-5
changelog:
  - EA-13474: Security: backport CVE-2026-8924 (trailing dot domain super cookie bypass PSL, Low)
  - EA-13474: Security: backport CVE-2026-9079 (stale proxy password on NULL userpwd, Medium)
  - EA-13474: Security: backport CVE-2026-8286 (STARTTLS connection reuse ignores TLS config, Low)
  - EA-13474: Security: backport CVE-2026-9080 (UAF after curl_easy_pause in socket callback, Low)
  - EA-13474: Security: backport CVE-2026-8927 (cross-proxy Digest auth state leak via env proxy, Medium)
  - EA-13474: Security: backport CVE-2026-10536 (HTTP/2 stream-dependency tree UAF, Low)
  - EA-13474: Security: backport CVE-2026-11564 (native CA trust persists after handle reuse, Low)
  - EA-13474: Security: backport CVE-2026-8932 (incomplete mTLS config match in conn reuse, Low)
  - EA-13474: Security: backport CVE-2026-12064 (proto-default skips SSH host verification on schemeless URLs, Low)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.17.0-6
changelog:
  - EA-13474: Security: backport CVE-2026-8458 (Negotiate connection reuse ignores CURLOPT_SERVICE_NAME, Low)
  - EA-13474: Security: backport CVE-2026-8926 (netrc returns wrong user's password on login mismatch, Low)
  - EA-13474: Security: backport CVE-2026-11586 (WebSocket auto-PONG unbounded memory allocation, Low)
  - EA-13474: Security: backport CVE-2026-11856 (cross-origin Digest auth state leak on handle reuse, Medium)


author: Rex Dieter <rdieter@fedoraproject.org> - 0.99.0-20.20091203
changelog:
  - 20091203 snapshot
  - spec housecleaning
  - Tidy erroniously removes whitespace, causing mangled text (#481350)


author: Cory McIntire <cory@cpanel.net> - 2.13.3-2
changelog:
  - EA-12336: Rolling “ea-libxml2” back to “f77d3db2ad0957accee0eda34f1bb8bc66a9bb5c”: breaks older php-pears


author: Cory McIntire <cory.mcintire@webpros.com> - 2.13.8-1
changelog:
  - EA-12821: Update ea-libxml2 from v2.13.6 to v2.13.8
  - [CVE-2025-32415] schemas: Fix heap buffer overflow in xmlSchemaIDCFillNodeTables
  - [CVE-2025-32414] python: Read at most len/4 characters. (Maks Verver)


author: Cory McIntire <cory.mcintire@webpros.com> - 3.3.8-1
changelog:
  - EA-13308: Update ea-modsec2-rules-owasp-crs from v3.3.7 to v3.3.8
  - CVE-2026-21876: Rule 922110 only validates the LAST multipart part’s charset, allowing malicious charsets in earlier parts to bypass detection


author: EA4 Update Bot <cory.mcintire@webpros.com> - 3.3.9-1
changelog:
  - EA-13393: Update ea-modsec2-rules-owasp-crs from v3.3.8 to v3.3.9
  - CVE-2026-33691: File upload detection bypass via whitespace padding in PHP double-extension, PHP upload, and JSP file upload detection


author: Sergey Fokin <sfokin@cloudlinux.com> - 1:3.0.15-1.cloudlinux
changelog:
  - EA-13435: Update ea-modsec30 from v3.0.14 to v3.0.15
  - EA-13435: Switch pcre-devel to pcre2-devel; ModSecurity 3.0.15 requires PCRE2


author: Daniel Muey <dan@cpanel.net> - 3.0.4-3
changelog:
  - ZC-7506: Support `/usr/local/cpanel/3rdparty/share/geoipfree/IpToCountry.dat` as a value for `SecGeoLookupDb`
  - ZC-7507: Add lua support


author: Cory McIntire <cory.mcintire@webpros.com> - 0.0.9beta1-16
changelog:
  - EA-13435: Fix libxml2.so.16 runtime load failure introduced by ea-modsec30 3.0.15 (new SONAME)
  - EA-13435: Use ea-libxml2 on el7/el8 (BuildRequires, Requires, conditional LDFLAGS)
  - EA-13435: Add pcre2-devel and lua-devel BuildRequires for modsec 3.0.15 transitive deps
  - EA-13435: Use patchelf in install to embed ea-libxml2 path in mod_security3.so RPATH (APR libtool ignores LDFLAGS at link time)
  - EA-13435: Add undefine brp_remove_rpath to preserve embedded RPATH


author: Sergey Fokin <sfokin@cloudlinux.com> - 1:0.0.9beta1-16.cloudlinux
changelog:
  - EA-13435: Merge with cpanel 0.0.9beta1-16
  - EA-13435: Use ea-libxml2 on el7/el8, pcre2-devel, lua-devel for modsec 3.0.15
  - EA-13435: Add undefine brp_remove_rpath to preserve embedded RPATH
  - EA-13435: Exclude rhel >= 10 (ea-modsec30 not available)


author: Cory McIntire <cory.mcintire@webpros.com> - 1.68.1-2
changelog:
  - EA-13378: Add CVE documentation for nghttp2 1.68.1
  - CVE-2026-27135: Denial of service via assertion failure due to missing state validation (CVSS 7.5)


author: Dan Muey <daniel.muey@webpros.com> - 1.29.1-1
changelog:
  - EA-13069: Update ea-nginx from v1.26.3 to v1.29.1
  - CVE-2025-53859: A security issue in ngx_mail_smtp_module,which might allow an attacker to cause buffer over-read


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> alutsiuk <alutsiuk@cloudlinux.com> - 3:1.29.1-1.cloudlinux

changelog:
  - MAXWS-821: Fixed ea-nginx build after merge of nginx-1.29.1 version
  - MAXWS-793: Bump conflict version for max_webserver
  - MAXWS-756: Remove lsapi_check_script directive from cpanel-lsapi.conf
  - MAXWS-673: Implemented varmatch block based on precompiled action handlers


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 3:1.29.1-1.cloudlinux.1
changelog:
  - MAXWS-821: Evaluate varmatch block for access directives in the access phase
  - MAXWS-828: Added return and return_status_code directives support in varmatch block
  - MAXWS-849: Added remove_type directive support in nginx
  - MAXWS-851: Normalize varmatch regex with base= to match filenames
  - MAXWS-828: Fixed error_page usage in varmatch if defined in global context
  - MAXWS-861: Fixed regex normalization and matching under varmatch subdirs
  - MAXWS-889: Re-evaluate varmatch rules against the resolved index file URI


author: Cory McIntire <cory.mcintire@webpros.com> - 1.29.5-1
changelog:
  - EA-13333: Update ea-nginx from v1.29.4 to v1.29.5
  - Security: an attacker might inject plain text data in the response from an SSL backend (CVE-2026-1642).


author: Cory McIntire <cory.mcintire@webpros.com> - 1.29.7-1
changelog:
  - EA-13381: Update ea-nginx from v1.29.6 to v1.29.7
  - Security: buffer overflow in COPY or MOVE request handling with "alias" directive (CVE-2026-27654).
  - Security: processing of a specially crafted MP4 file by ngx_http_mp4_module on 32-bit platforms might cause a worker process crash (CVE-2026-27784).
  - Security: processing of a specially crafted MP4 file by ngx_http_mp4_module might cause a worker process crash (CVE-2026-32647).
  - Security: segmentation fault in worker process with CRAM-MD5 or APOP authentication when retry enabled (CVE-2026-27651).
  - Security: PTR DNS record injection in auth_http requests and XCLIENT command (CVE-2026-28753).
  - Security: SSL handshake succeeds despite OCSP rejecting client certificate in stream module (CVE-2026-28755).


author: Cory McIntire <cory.mcintire@webpros.com> - 1.31.0-1
changelog:
  - EA-13436: Update ea-nginx from v1.30.0 to v1.31.0
  - Security: heap buffer overflow in ngx_http_rewrite_module (CVE-2026-42945).


author: Cory McIntire <cory.mcintire@webpros.com> - 1.31.1-1
changelog:
  - EA-13448: Update ea-nginx from v1.31.0 to v1.31.1
  - Security: remote code execution via worker process memory pool handling (CVE-2026-9256).


author: EA4 Update Bot <cory.mcintire@webpros.com> - 1.31.3-1
changelog:
  - EA-13503: Update ea-nginx from v1.31.2 to v1.31.3
  - Security: heap buffer overflow when using map with regex, potentially allowing remote code execution or worker process denial of service via a crafted HTTP request (CVE-2026-42533).
  - Security: memory disclosure when using the ngx_http_slice_module (CVE-2026-60005).
  - Security: use-after-free when using the ngx_http_ssi_module (CVE-2026-56434).


author: CloudLinux <packages@cloudlinux.com> - 0.64-7
changelog:
  * Thu Apr 16 2026 Cory McIntire <cory.mcintire@webpros.com> - 0.64-7
  - EA-13411: Build against ea-nginx version v1.30.0


author: Sergey Fokin <sfokin@cloudlinux.com> - 0.65-1.cloudlinux.1
changelog:
  - EA-13468: Use %{version} for Source0/setup; drop stale module_version macro (fixes v0.64.tar.gz not found)


author: CloudLinux <packages@cloudlinux.com> - 0.39-9
changelog:
  * Thu Apr 16 2026 Cory McIntire <cory.mcintire@webpros.com> - 0.39-9
  - EA-13411: Build against ea-nginx version v1.30.0


author: CloudLinux <packages@cloudlinux.com> - 0.9.6-5
changelog:
  * Thu Apr 16 2026 Cory McIntire <cory.mcintire@webpros.com> - 0.9.6-5
  - EA-13411: Build against ea-nginx version v1.30.0


author: CloudLinux <packages@cloudlinux.com> - 6.1.2-6
changelog:
  * Thu Apr 16 2026 Cory McIntire <cory.mcintire@webpros.com> - 6.1.2-6
  - EA-13411: Build against ea-nginx version v1.30.0


author: Dan Muey <dan@cpanel.net> - 16.13.1-2
changelog:
  - ZC-9571: Explicitly conflict w/ `ea-nodejs10` so that DNF does not simply downgrade it to get around the conflict


author: Cory McIntire <cory@cpanel.net> - 16.19.1-1
changelog:
  - EA-11255: Update ea-nodejs16 from v16.19.0 to v16.19.1
  - [CVE-2023-23918) Node.js Permissions policies can be bypassed via process.mainModule (High)
  - [CVE-2023-23919) Node.js OpenSSL error handling issues in nodejs crypto library (Medium)
  - [CVE-2023-23920] Node.js insecure loading of ICU data through ICU_DATA environment variable (Low)
  - [CVE-2023-23936] Fetch API in Node.js did not protect against CRLF injection in host headers (Medium)
  - [CVE-2023-24807] Regular Expression Denial of Service in Headers in Node.js fetch API (Low)


author: Cory McIntire <cory@cpanel.net> - 16.20.2-1
changelog:
  - EA-11604: Update ea-nodejs16 from v16.20.1 to v16.20.2
  	- CVE-2023-32559: Policies can be bypassed via process.binding
  	- CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire
  	- CVE-2023-32002:  Policies can be bypassed via Module.\_load
  	- OpenSSL sources upgraded upstream to latest


author: Cory McIntire <cory@cpanel.net> - 1.1.1v-1
changelog:
  - EA-11578: Update ea-openssl11 from v1.1.1u to v1.1.1v
  	- Fix excessive time spent checking DH q parameter value (CVE-2023-3817)
  	- Fix DH_check() excessive time with over sized modulus (CVE-2023-3446)


author: Cory McIntire <cory@cpanel.net> - 1.1.1w-1
changelog:
  - EA-11665: Update ea-openssl11 from v1.1.1v to v1.1.1w
  	- Fix POLY1305 MAC implementation corrupting XMM registers on Windows (CVE-2023-4807)


author: Dmitriy Popov <dpopov@cloudlinux.com> - 1.1.1w-2.tuxcare.els2
changelog:
  - CVE-2024-0727: properly accounting PKCS12 struct fields to prevent DoS
  - Extend modulus checking for parameters in existed patch for CVE-2023-5678


author: Dmitriy Popov <dpopov@cloudlinux.com> - 1.1.1w-6.tuxcare.els
changelog:
  - CVE-2026-22796: fix ASN1_TYPE type confusion in PKCS7_digest_from_attributes
    by validating type before accessing as OCTET_STRING
  - CVE-2025-69420: fix missing ASN1_TYPE validation in TS_RESP_verify_response
    for signing certificate attributes
  - CVE-2025-69421: fix NULL pointer dereference in PKCS12_item_decrypt_d2i
    by adding NULL check for oct parameter
  - CVE-2025-68160: fix heap buffer overflow in BIO_f_linebuffer when next BIO
    performs short writes
  - CVE-2025-69418: fix OCB AES-NI/HW stream path leaving trailing bytes
    unauthenticated/unencrypted by advancing pointers after stream processing
  - CVE-2025-69419: fix out-of-bounds write in OPENSSL_uni2utf8 and do_buf
    by checking return code of UTF8_putc/bmp_to_utf8
  - CVE-2026-22795: fix ASN1_TYPE validation in PKCS12 parsing (p12_kiss.c)
    and s_client.c before accessing union members


author: Dmitriy Popov <dpopov@cloudlinux.com> - 1.1.1w-7.tuxcare.els
changelog:
  - CVE-2026-28387: fix use-after-free in DANE client code by using X509_free()
    instead of OPENSSL_free() to properly release reference-counted X509 objects
  - CVE-2026-28388: fix NULL pointer dereference when processing a delta CRL
    that has a Delta CRL Indicator but lacks a CRL Number extension
  - CVE-2026-28389: fix NULL pointer dereference in CMS KeyAgreeRecipientInfo
    processing when KeyEncryptionAlgorithmIdentifier omits the optional
    parameter field, by using safe X509_ALGOR_get0() extraction
  - CVE-2026-28390: fix NULL pointer dereference in CMS KeyTransportRecipientInfo
    processing when RSA-OAEP SourceFunc parameters are missing, by using safe
    X509_ALGOR_get0() extraction and OPENSSL_memdup() for label data


author: Sergey Fokin <sfokin@cloudlinux.com> - 1.1.1w-8.tuxcare.els
changelog:
  - EA4D-871: Update ea-openssl11 from 1.1.1w-7 to 1.1.1w-8
  - CVE-2026-45447: fix heap use-after-free in PKCS7_verify() by popping and
    freeing each BIO in the p7bio chain on the error path instead of relying on
    BIO_free_all() over a chain whose tail may be owned by the caller
  - CVE-2026-34180: fix heap buffer over-read in ASN.1 content parsing by
    rejecting length values that do not fit in an int before they are passed to
    ASN1_STRING_set() and c2i_ASN1_OBJECT() from asn1_ex_c2i()
  - CVE-2026-7383: fix possible heap buffer overflow in ASN.1 multibyte string
    conversion by range-checking the BMPSTRING/UNIVERSALSTRING output size and
    the UTF-8 byte-count accumulator in ASN1_mbstring_ncopy()
  - CVE-2026-9076: fix out-of-bounds read in CMS password-based decryption by
    rejecting KEK ciphers with a block size below 4 octets in kek_unwrap_key()
  - CVE-2026-42766: fix NULL pointer dereference in CMS password-based decryption
    when the optional keyDerivationAlgorithm is absent from PasswordRecipientInfo


author: Cory McIntire <cory.mcintire@webpros.com> - 6.0.26-1
changelog:
  - EA-12725: Update ea-passenger-src from v6.0.25 to v6.0.26
    * [CVE-2025-26803] The http parser (from Passenger 6.0.21-6.0.25) was susceptible to a denial of service attack when parsing a request with an invalid HTTP method.


author: Dan Muey <daniel.muey@webpros.com> - 6.1.0-2
changelog:
  - EA4-223: Move A10 host-flag-support from Apache module that uses this src ball (that way NGINX benefits form it too w/out duplicating efforts)


author: Edwin Buck <e.buck@cpanel.net> - 0.1.0-1
changelog:
  - EA-5110: Add /usr/local/bin/php targets to php-cli
             Change /usr/bin/php targets to php-cgi


author: Dan Muey <dan@cpanel.net> - 0.2.0-5
changelog:
  - EA-6569: fix `-ea_php NN` handling to set package name
  - EA-6542: Ignore commented out MIME Types
  - EA-6543: ignore .htaccess 'mime type packages' that does not contain '-php'


author: Daniel Muey <dan@cpanel.net> - 1.0.0-1
changelog:
  - ZC-4400: rewrite to make it easier to work with and fix all the bugs
  - ZC-4425: deprecate -ea_php flag


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.1.6-24.cloudlinux.33
changelog:
  - Fix for hardened PHP
  - CVE-2023-3823: Fix external entity loading in XML without enabling by
    sanitizing libxml2 globals before parsing


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.1.6-24.cloudlinux.36
changelog:
  - Fix for hardened PHP
  - CVE-2022-31629: use stack instead of heap, check correct one var
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.1.6-24.cloudlinux.39
changelog:
  - Security fixes
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.1.6-24.cloudlinux.40
changelog:
  - Security fixes
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter


author: Sergey Fokin <sfokin@cloudlinux.com> - 1:5.1.6-24.cloudlinux.43
changelog:
  - EA4D-797: revert to use system libxml2 lib for all platforms
  - EA4D-811: remove libphp5.so from _root_httpd_moddir to fix file conflicts


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.2.17-27.cloudlinux.52
changelog:
  - Security fixes
  - CVE-2018-19935: fix null pointer dereference in imap_mail
  - CVE-2018-14883: fix int overflow leading to heap-based buffer over-read in
    exif.c
  - CVE-2018-20783: fix a buffer over-read in PHAR reading functions


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.2.17-27.cloudlinux.53
changelog:
  - Security fixes
  - CVE-2018-17082: fix cross-site scripting in apache2handler sapi
  - CVE-2018-19518: disable rsh/ssh functionality in imap to prevent argument
    Injection


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 5.2.17-27.cloudlinux.54
changelog:
  - Security fixes
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation
  - CVE-2020-7071: avoid parse_url() returning a wrong host to user


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.2.17-27.cloudlinux.55
changelog:
  - Security fixes
  - CVE-2019-9022: fix DNS response parsing
  - CVE-2019-11034: fix possible infoleak or crush caused by read past allocated
    buffer in exif_process_IFD_TAG()
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()
  - CVE-2019-9023: complete fix heap-based buffer over-read in mbstring regular
    expression functions when supplied with invalid multibyte data


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.2.17-27.cloudlinux.58
changelog:
  - Security fixes
  - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large
    XML namespace prefix
  - CVE-2025-1220: fix null byte termination in hostnames


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 5.2.17-27.cloudlinux.60
changelog:
  - EA4D-789: Add missing CVE patches from alt-php52
  - CVE-2012-2688, CVE-2017-11143, CVE-2017-11145, CVE-2017-11146
  - CVE-2017-7890, CVE-2017-9224, CVE-2017-9226, CVE-2017-9227
  - CVE-2017-9228, CVE-2017-9229
  - CVE-2019-19246, CVE-2021-21704


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:5.2.17-27.cloudlinux.65
changelog:
  - ELS-2599: Sync CVE patches from alt-php52
  - CVE-2012-0057, CVE-2012-0789, CVE-2013-4113, CVE-2014-2497,
    CVE-2014-3515, CVE-2014-4721, CVE-2014-9709, CVE-2015-0232,
    CVE-2016-5385, CVE-2026-6722, CVE-2026-7261, CVE-2026-7262


author: S. Kurt Newman <kurt.newman@cpanel.net> - 4.7.5-5
changelog:
  - Added scl_package_override macro to regain access to global
    PHP macros that contain location and verison information.


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 5.3.29-29.cloudlinux.53
changelog:
  - Security fixes
  - CVE-2020-7068: fix using of freed hash key in the phar_parse_zipfile function
  - CVE-2020-7071: avoid parse_url() returning a wrong host to user


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.3.29-29.cloudlinux.54
changelog:
  - Security fixes
  - CVE-2018-14883: fix int overflow leading to heap-based buffer over-read in
    exif.c
  - CVE-2018-20783: fix a buffer over-read in PHAR reading functions
  - CVE-2018-19935: fix null pointer dereference in imap_mail


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.3.29-29.cloudlinux.55
changelog:
  - Security fixes
  - CVE-2018-17082: fix cross-site scripting in apache2handler sapi
  - CVE-2018-19518: disable rsh/ssh functionality in imap to prevent argument
    injection


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 5.3.29-29.cloudlinux.56
changelog:
  - Security fixes
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.3.29-29.cloudlinux.57
changelog:
  - Security fixes
  - CVE-2019-9022: fix DNS response parsing
  - CVE-2019-11034: fix possible infoleak or crush caused by read past allocated
    buffer in exif_process_IFD_TAG()
  - CVE-2019-11036: fix infoleak of crash via read past allocated buffer in
    exif_process_IFD_TAG()
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()
  - CVE-2019-9023: complete fix heap-based buffer over-read in mbstring regular
    expression functions when supplied with invalid multibyte data


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 5.3.29-29.cloudlinux.62
changelog:
  - EA4D-789: Add missing CVE patches from alt-php53
  - CVE-2016-7478, CVE-2019-19246
  - CVE-2019-11035, CVE-2021-21704, CVE-2017-11143, CVE-2017-11145
  - CVE-2017-11146, CVE-2017-7890, CVE-2017-9224, CVE-2017-9226
  - CVE-2017-9227, CVE-2017-9228, CVE-2017-9229
  - EA4D-793: Update php-fpm LVE patch


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:5.3.29-29.cloudlinux.67
changelog:
  - ELS-2599: Sync CVE patches from alt-php53
  - CVE-2013-7345, CVE-2014-1943, CVE-2014-3538, CVE-2015-4604,
    CVE-2016-5385, CVE-2026-14355, CVE-2026-6722, CVE-2026-6735,
    CVE-2026-7261, CVE-2026-7262


author: Remi Collet <rcollet@redhat.com> 1.1-4
changelog:
  - avoid empty debuginfo subpackage
  - add LICENSE, README and php54.7 man page #1061454
  - add scldevel subpackage #1063356


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.4.45-79.cloudlinux.15
changelog:
  - Security fixes
  - CVE-2025-1220: fix null byte termination in hostnames
  - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large
    XML namespace prefix


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 5.4.45-82.cloudlinux.2
changelog:
  - EA4D-789: Add missing CVE patches from alt-php54
  - CVE-2017-11143, CVE-2017-7890
  - CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228
  - CVE-2017-9229, CVE-2019-11035, CVE-2019-19246, CVE-2021-21704
  - EA4D-793: Update php-fpm LVE patch


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:5.4.45-82.cloudlinux.7
changelog:
  - ELS-2599: Sync CVE patches from alt-php54
  - CVE-2016-5385, CVE-2026-14355, CVE-2026-6722, CVE-2026-6735,
    CVE-2026-7261, CVE-2026-7262


author: Remi Collet <rcollet@redhat.com> 1.1-5
changelog:
  - avoid empty debuginfo subpackage
  - add LICENSE, README and php55.7 man page #1061455
  - add scldevel subpackage #1063357


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.5.38-62.cloudlinux.11
changelog:
  - Security fixes
  - CVE-2019-9022: fix DNS response parsing
  - CVE-2019-11034: fix possible infoleak or crush caused by read past allocated
    buffer in exif_process_IFD_TAG()
  - CVE-2019-11036: fix infoleak of crash via read past allocated buffer in
    exif_process_IFD_TAG()
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 5.5.38-64.cloudlinux.1
changelog:
  - EA4D-789: Add missing CVE patches from alt-php55
  - CVE-2017-11143, CVE-2017-7890
  - CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228
  - CVE-2017-9229, CVE-2019-11035, CVE-2019-19246, CVE-2019-13224
  - CVE-2021-21704
  - EA4D-793: Update php-fpm LVE patch


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:5.5.38-64.cloudlinux.7
changelog:
  - ELS-2599: Sync CVE patches from alt-php55
  - CVE-2016-1283, CVE-2026-14355, CVE-2026-6722, CVE-2026-6735,
    CVE-2026-7261, CVE-2026-7262


author: Dan Muey <dan@cpanel.net> - 3.3-7
changelog:
  - EA-5028 via EA-5900: reinstate opcache conflict
  - (the obsoletes is problematic and there is a
  -   proper way to address the problem it was intended to solve)


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 1:3.3-8.cloudlinux.4
changelog:
  - Stop bundling opcache.so for PHP 5.5/5.6 to allow coexistence with php-opcache
  - Remove Conflicts with php-opcache (no longer needed without bundled opcache.so)
  - Strip invalid RPATH from ZendGuardLoader.so
  - Exclude ea-php55 and older zendguard builds on RHEL >= 9 (no devel packages available)


author: Arseniy Zolotarev <azolotarev@cloudlinux.com> - 1:5.6.40-25.cloudlinux.3
changelog:
  - EA4D-746: Update php-fpm lve patch to extract doc_root from php_admin_values
    for CageFS per-domain isolation


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:5.6.40-25.cloudlinux.14
changelog:
  - ELS-2599: Sync CVE patches from alt-php56
  - CVE-2026-14355, CVE-2026-6722, CVE-2026-6735, CVE-2026-7261,
    CVE-2026-7262


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.0.33-29.cloudlinux.9
changelog:
  - EA4D-797: revert to use system libxml2 lib for all platforms
  - EA4D-811: remove libphp7.so from _root_httpd_moddir to fix file conflicts


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:7.0.33-29.cloudlinux.13
changelog:
  - ELS-2599: Sync CVE patches from alt-php70
  - CVE-2026-14355, CVE-2026-6722, CVE-2026-6735, CVE-2026-7261,
    CVE-2026-7262, CVE-2026-7568


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.0.33-26.cloudlinux.6
changelog:
  - Security fixes
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - Bug #74960: fix heap buffer overflow via str_repeat
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.0.33-26.cloudlinux.8
changelog:
  - Security fixes
  - CVE-2017-9120: Integer overflow in mysqli_real_escape_string()
  - CVE-2017-9119: handle memory limit error during string reallocation correctly
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl
  - CVE-2020-7071: avoid parse_url() returning a wrong host to user


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.0.33-26.cloudlinux.9
changelog:
  - Security fixes
  - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.0.33-26.cloudlinux.10
changelog:
  - Security fixes
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()
  - CVE-2019-11034: fix possible infoleak or crush caused by read past allocated
    buffer in exif_process_IFD_TAG()
  - CVE-2019-11036: fix infoleak of crash via read past allocated buffer in
    exif_process_IFD_TAG()
  - CVE-2019-11035: fix potential infoleak or crash via read past allocated buffer
    in exif_iif_add_value()
  - CVE-2019-9022: fix DNS response parsing


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:7.1.33-20.cloudlinux.13
changelog:
  - ELS-2599: Sync CVE patches from alt-php71
  - CVE-2026-14355, CVE-2026-6722, CVE-2026-6735, CVE-2026-7261,
    CVE-2026-7262, CVE-2026-7568


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.1.33-17.cloudlinux.8
changelog:
  - Security fixes
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl
  - CVE-2017-8923: fix integer overflow when concatenating strings
  - CVE-2017-9120: Integer overflow in mysqli_real_escape_string()
  - CVE-2017-9119: handle memory limit error during string reallocation correctly
  - CVE-2020-7071: avoid parse_url() returning a wrong host to user


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.1.33-17.cloudlinux.9
changelog:
  - Security fixes
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation
  - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.1.33-17.cloudlinux.10
changelog:
  - Security fixes
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 7.2.34-12.cloudlinux.6
changelog:
  - EA4D-789: Security fixes
  - CVE-2025-14178: fix integer overflow in array_merge (ext/standard/array.c)


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 1:7.2.34-12.cloudlinux.11
changelog:
  - ALTPHP-2422: Disable OPcache SCCP pass (bit 0x80) in default optimization_level
    to avoid runtime infinite loop caused by SCCP+DFA miscompilation
    (e.g. WordPress wp_replace_in_html_tags on CloudLinux 10 + cPanel)


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:7.2.34-12.cloudlinux.14
changelog:
  - ELS-2599: Sync CVE patches from alt-php72
  - CVE-2026-14355, CVE-2026-6722, CVE-2026-6735, CVE-2026-7261,
    CVE-2026-7262, CVE-2026-7568


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.2.34-9.cloudlinux.5
changelog:
  - Security fixes
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - Bug #74267: fix segfault with streams and invalid datas
  - Bug #74960: fix heap buffer overflow via str_repeat
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.2.34-9.cloudlinux.7
changelog:
  - Security fixes
  - CVE-2017-8923: fix integer overflow when concatenating strings
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl
  - CVE-2017-9119: handle memory limit error during string reallocation correctly
  - CVE-2017-9120: integer overflow in mysqli_real_escape_string()


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.2.34-9.cloudlinux.9
changelog:
  - Security fixes
  - CVE-2019-19246: fix heap-based buffer over-read in str_lower_case_match in
    regexec.c
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 1:7.3.33-15.cloudlinux.6
changelog:
  - EA4D-789: Security fixes
  - CVE-2025-14178: fix integer overflow in array_merge (ext/standard/array.c)
  - CVE-2025-1736: fix for PHP SOAP extension


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 1:7.3.33-15.cloudlinux.12
changelog:
  - CLOS-4167: Add per-domain site isolation support to LiteSpeed SAPI; updated DEB LiteSpeed SAPI source to 8.3


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:7.3.33-15.cloudlinux.14
changelog:
  - ELS-2599: Sync CVE patches from alt-php73
  - CVE-2026-14355, CVE-2026-6722, CVE-2026-6735, CVE-2026-7261,
    CVE-2026-7262, CVE-2026-7568


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.3.33-13.cloudlinux.7
changelog:
  - EA4D-789: Security fixes
  - CVE-2025-1220: fix null byte termination in hostnames
  - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large
    XML namespace prefix


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.3.33-13.cloudlinux.1
changelog:
  - Security fixes
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.3.33-13.cloudlinux.2
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - Bug #74960: fix heap buffer overflow via str_repeat
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.3.33-13.cloudlinux.4
changelog:
  - Security fixes
  - CVE-2017-8923: fix integer overflow when concatenating strings
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.4.33-18.cloudlinux.6
changelog:
  - EA4D-797: revert to use system libxml2 lib for all platforms
  - EA4D-808: fix Provides field in debian/control to use exact versions
  - EA4D-811: remove libphp7.so from _root_httpd_moddir to fix file conflicts


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:7.4.33-18.cloudlinux.10
changelog:
  - ELS-2599: Sync CVE patches from alt-php74
  - CVE-2026-14355, CVE-2026-6722, CVE-2026-6735, CVE-2026-7261,
    CVE-2026-7262, CVE-2026-7568


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 7.4.33-13.cloudlinux.5
changelog:
  - EA4D-789: Security fixes
  - CVE-2024-11235: use-after-free for ??= due to incorrect live-range calculation


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 1:8.0.30-9.cloudlinux.4
changelog:
  - EA4D-789: Security fixes
  - CVE-2024-5458: filter_var URL validation fix
  - CVE-2024-8925: multipart form data parsing fix
  - CVE-2024-8927: cgi.force_redirect configuration bypass
  - CVE-2024-9026: error log parsing fix
  - CVE-2025-14178: integer overflow in array_merge


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 1:8.0.30-9.cloudlinux.8
changelog:
  - CLOS-4167: Add per-domain site isolation support to LiteSpeed SAPI; updated LiteSpeed SAPI source to 8.3


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:8.0.30-9.cloudlinux.10
changelog:
  - ELS-2599: Sync CVE patches from alt-php80
  - CVE-2025-14179, CVE-2026-14355, CVE-2026-6722, CVE-2026-6735,
    CVE-2026-7259, CVE-2026-7261, CVE-2026-7262, CVE-2026-7568


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 8.0.30-8.cloudlinux.3
changelog:
  - EA4D-789: Security fixes
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation
  - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 8.0.30-8.cloudlinux.4
changelog:
  - EA4D-789: Security fixes
  - CVE-2024-11235: use-after-free for ??= due to incorrect live-range
    calculation


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 8.0.30-8.cloudlinux.6
changelog:
  - EA4D-789: Security fixes
  - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large
    XML namespace prefix
  - CVE-2025-1220: fix null byte termination in hostnames


author: Cory McIntire <cory.mcintire@webpros.com> - 8.1.32-1
changelog:
  - EA-12766: Update ea-php81 from v8.1.31 to v8.1.32
      - Fixed GHSA-hgf54-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
      - Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
      - Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
      - Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
      - Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header when requesting a redirected resource). (CVE-2025-1219)
      - Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown causes Use-After-Free). (CVE-2024-11235)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.1.33-1
changelog:
  - EA-13001: Update ea-php81 from v8.1.32 to v8.1.33
  	- Fixed GHSA-hrwm-9436-5mv3 (pgsql extension does not check for errors during escaping). (CVE-2025-1735)
  	- Fixed GHSA-453j-q27h-5p8x (NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix). (CVE-2025-6491)
  	- Fixed GHSA-3cr5-j632-f35r (Null byte termination in hostnames). (CVE-2025-1220)


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 1:8.1.34-1.cloudlinux
changelog:
  - EA4D-789: Update ea-php81 from v8.1.33 to v8.1.34
  - Fixed CVE-2025-14177
  - Fixed CVE-2025-14178: integer overflow in array_merge
  - Fixed CVE-2025-14180
  - EA4D-793: Update php-fpm LVE patch


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:8.1.34-1.cloudlinux.7
changelog:
  - ELS-2599: Sync CVE patches from alt-php81
  - CVE-2025-14179, CVE-2026-14355, CVE-2026-6722, CVE-2026-6735,
    CVE-2026-7259, CVE-2026-7261, CVE-2026-7262, CVE-2026-7568


author: Cory McIntire <cory@cpanel.net> - 8.2.26-1
changelog:
  - EA-12577: Update ea-php82 from v8.2.25 to v8.2.26
  - (Single byte overread with convert.quoted-printable-decode filter). (CVE-2024-11233)
  - (Configuring a proxy in a stream context might allow for CRLF injection in URIs). (CVE-2024-11234)
  - (Integer overflow in the dblib quoter causing OOB writes). (CVE-2024-11236)
  - (Integer overflow in the firebird quoter causing OOB writes). (CVE-2024-11236)
  - (Leak partial content of the heap through heap buffer over-read). (CVE-2024-8929)
  - (OOB access in ldap_escape). (CVE-2024-8932)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.2.28-1
changelog:
  - EA-12772: Update ea-php82 from v8.2.27 to v8.2.28
      - Fixed GHSA-hgf54-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
      - Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
      - Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
      - Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
      - Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header when requesting a redirected resource). (CVE-2025-1219)
      - Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown causes Use-After-Free). (CVE-2024-11235)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.2.29-1
changelog:
  - EA-12996: Update ea-php82 from v8.2.28 to v8.2.29
  - Fixed GHSA-3cr5-j632-f35r (Null byte termination in hostnames). (CVE-2025-1220)
  - Fixed GHSA-453j-q27h-5p8x (NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix). (CVE-2025-6491)
  - Fixed GHSA-hrwm-9436-5mv3 (pgsql extension does not check for errors during escaping). (CVE-2025-1735)


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 1:8.2.30-1.cloudlinux
changelog:
  - EA4D-789: Update ea-php82 from v8.2.29 to v8.2.30
  - Fixed CVE-2025-14177
  - Fixed CVE-2025-14178: integer overflow in array_merge
  - Fixed CVE-2025-14180
  - EA4D-793: Update php-fpm LVE patch


author: Sergey Fokin <sfokin@cloudlinux.com> - 1:8.2.31-1.cloudlinux
changelog:
  - EA4D-837: Update ea-php82 from v8.2.30 to v8.2.31
  - Fixed GHSA-7qg2-v9fj-4mwv (XSS within FPM status endpoint). (CVE-2026-6735)
  - Fixed GHSA-wm6j-2649-pv75 (Null pointer dereference in mb_ereg_search_init()). (CVE-2026-7259)
  - Fixed GHSA-w476-322c-wpvm (SQL injection via NUL bytes in PDO_Firebird). (CVE-2025-14179)
  - Fixed GHSA-85c2-q967-79q5 (Stale SOAP_GLOBAL ref_map pointer). (CVE-2026-6722)
  - Fixed GHSA-m33r-qmcv-p97q (Use-after-free in SOAP persistence session). (CVE-2026-7261)
  - Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check in SOAP). (CVE-2026-7262)
  - Fixed GHSA-96wq-48vp-hh57 (Signed integer overflow of char array offset). (CVE-2026-7568)
  - Fixed GHSA-m8rr-4c36-8gq4 (Unsigned char handling in ctype.h functions). (CVE-2026-7258)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.2.31-1
changelog:
  - EA-13427: Update ea-php82 from v8.2.30 to v8.2.31
  - Fixed GHSA-7qg2-v9fj-4mwv (XSS within FPM status endpoint). (CVE-2026-6735)
  - Fixed GHSA-wm6j-2649-pv75 (Null pointer dereference in mb_ereg_search_init()). (CVE-2026-7259)
  - Fixed GHSA-w476-322c-wpvm (SQL injection via NUL bytes in PDO_Firebird). (CVE-2025-14179)
  - Fixed GHSA-85c2-q967-79q5 (Stale SOAP_GLOBAL ref_map pointer). (CVE-2026-6722)
  - Fixed GHSA-m33r-qmcv-p97q (Use-after-free in SOAP persistence session). (CVE-2026-7261)
  - Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check in SOAP). (CVE-2026-7262)
  - Fixed GHSA-96wq-48vp-hh57 (Signed integer overflow of char array offset). (CVE-2026-7568)
  - Fixed GHSA-m8rr-4c36-8gq4 (Unsigned char handling in ctype.h functions). (CVE-2026-7258)


author: EA4 Update Bot <cory.mcintire@webpros.com> - 8.2.32-1
changelog:
  - EA-13482: Update ea-php82 from v8.2.31 to v8.2.32
  - Fixed bug GH-22187 (Memory corruption in openssl_encrypt with AES-WRAP-PAD). (CVE-2026-14355)


author: Dan Muey <daniel.muey@webpros.com> - 8.3.29-1
changelog:
  - EA-13295: Update ea-php83 from v8.3.28 to v8.3.29
  - Fixed GHSA-8xr5-qppj-gvwj (PDO quoting result null deref). (CVE-2025-14180)
  - Fixed GHSA-h96m-rvf9-jgm2 (Heap buffer overflow in array_merge()). (CVE-2025-14178)
  - Fixed GHSA-3237-qqm7-mfv7 (Information Leak of Memory in getimagesize). (CVE-2025-14177)


author: Ilya Voyskovsky <ivoyskovsky@@cloudlinux.com> - 8.3.30-1.cloudlinux.5
changelog:
  - EA4D-806: Fix litespeed patches
  - ALTPHP-2369: Add LVD (Light Virtual Domain) support to fpm patches


author: Sergey Fokin <sfokin@cloudlinux.com> - 1:8.3.31-1.cloudlinux
changelog:
  - EA4D-837: Update ea-php83 from v8.3.30 to v8.3.31
  - Fixed GHSA-7qg2-v9fj-4mwv (XSS within FPM status endpoint). (CVE-2026-6735)
  - Fixed GHSA-wm6j-2649-pv75 (Null pointer dereference in mb_ereg_search_init()). (CVE-2026-7259)
  - Fixed GHSA-w476-322c-wpvm (SQL injection via NUL bytes in PDO_Firebird). (CVE-2025-14179)
  - Fixed GHSA-85c2-q967-79q5 (Stale SOAP_GLOBAL ref_map pointer). (CVE-2026-6722)
  - Fixed GHSA-m33r-qmcv-p97q (Use-after-free in SOAP persistence session). (CVE-2026-7261)
  - Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check in SOAP). (CVE-2026-7262)
  - Fixed GHSA-96wq-48vp-hh57 (Signed integer overflow of char array offset). (CVE-2026-7568)
  - Fixed GHSA-m8rr-4c36-8gq4 (Unsigned char handling in ctype.h functions). (CVE-2026-7258)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.3.31-1
changelog:
  - EA-13428: Update ea-php83 from v8.3.30 to v8.3.31
  - Fixed GHSA-7qg2-v9fj-4mwv (XSS within FPM status endpoint). (CVE-2026-6735)
  - Fixed GHSA-wm6j-2649-pv75 (Null pointer dereference in mb_ereg_search_init()). (CVE-2026-7259)
  - Fixed GHSA-w476-322c-wpvm (SQL injection via NUL bytes in PDO_Firebird). (CVE-2025-14179)
  - Fixed GHSA-85c2-q967-79q5 (Stale SOAP_GLOBAL ref_map pointer). (CVE-2026-6722)
  - Fixed GHSA-m33r-qmcv-p97q (Use-after-free in SOAP persistence session). (CVE-2026-7261)
  - Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check in SOAP). (CVE-2026-7262)
  - Fixed GHSA-96wq-48vp-hh57 (Signed integer overflow of char array offset). (CVE-2026-7568)
  - Fixed GHSA-m8rr-4c36-8gq4 (Unsigned char handling in ctype.h functions). (CVE-2026-7258)


author: EA4 Update Bot <cory.mcintire@webpros.com> - 8.3.32-1
changelog:
  - EA-13483: Update ea-php83 from v8.3.31 to v8.3.32
  - Fixed bug GH-21468 (TLS setup failure leading to remote DoS). (CVE-2026-12184)
  - Fixed bug GH-22187 (Memory corruption in openssl_encrypt with AES-WRAP-PAD). (CVE-2026-14355)


author: Dan Muey <daniel.muey@webpros.com> - 4:1.0-74
changelog:
  - EA4-204: Update “allphp allphp-opcache default default-nginx mpm_itk worker”
    profile(s):  add “ea-php83” based on “ea-php81”


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 4:1.0-75.cloudlinux.1
changelog:
  - EA4D-845: Extend ea-php80/83/84/85 coverage across all CL10 profiles
    (allphp, allphp-opcache, allphp_lsapi, allphp-opcache_lsapi, default,
    default_lsapi, default-nginx, default_passenger, worker — both clshared
    and clsolo). Brings CL10 to parity with CL9 which already covers all
    modern PHP versions. ea-php84/85 omit php-imap and php-pspell since
    upstream PHP no longer ships them; ea-php85 also omits php-opcache
    (not built for 8.5 on CL10).


author: Cory McIntire <cory@cpanel.net> - 6.2.14-1
changelog:
  - EA-11922: Update ea-redis62 from v6.2.8 to v6.2.14
  - CVE-2023-45145 ( Bypass permissions on socket on startups )
  - CVE-2022-24834 ( RCE )
  - CVE-2023-28856 ( Users can crash redis with invalid data )
  - CVE-2023-25155 ( Integer overflow can cause redis to terminate )
  - CVE-2022-36021 ( DoS - can cause redis to hang and consume 100% CPU time )
  - CVE-2022-35977, CVE-2023-22458 ( integer overflow issues / oom panic fixes )


author: Cory McIntire <cory@cpanel.net> - 6.2.16-1
changelog:
  - EA-12449: Update ea-redis62 from v6.2.14 to v6.2.16
  - (CVE-2024-31449) Lua library commands may lead to stack overflow and potential RCE.
  - (CVE-2024-31228) Potential Denial-of-service due to unbounded pattern matching.


author: Cory McIntire <cory@cpanel.net> - 6.2.17-1
changelog:
  - EA-12624: Update ea-redis62 from v6.2.16 to v6.2.17
  - (CVE-2024-46981) Lua script commands may lead to remote code execution


author: Cory McIntire <cory.mcintire@webpros.com> - 6.2.19-1
changelog:
  - EA-13003: Update ea-redis62 from v6.2.18 to v6.2.19
  - (CVE-2025-32023) Fix out-of-bounds write in HyperLogLog commands
  - (CVE-2025-48367) Retry accepting other connections even if the accepted connection reports an error


author: Cory McIntire <cory.mcintire@webpros.com> - 6.2.20-1
changelog:
  - EA-13172: Update ea-redis62 from v6.2.19 to v6.2.20
  - CVE-2025-49844: Lua script may lead to remote code execution
  - CVE-2025-46817: Lua script may lead to integer overflow and potential RCE
  - CVE-2025-46818: Lua script can be executed in context of another user
  - CVE-2025-46819: LUA out-of-bound read


author: Rishwanth Yeddula <rish@cpanel.net> - 5.1.8-2
changelog:
  - SEC-312: Stop reading the 'REVISION' file. This addresses an
    arbitrary file read vulnerability in passenger.


author: Daniel Muey <dan@cpanel.net> - 5.3.5-3
changelog:
  - ZC-4661: Make nodejs a requirement so that if they get one they get all of them, that way Application Manager has all the bells


author: Daniel Muey <dan@cpanel.net> - 6.0.7-2
changelog:
  - ZC-7655: Provide/Conflict `apache24-passenger`
  - ZC-7897: Add version/package specific template file (and support userdata paths like nginx)


author: Travis Holloway <t.holloway@cpanel.net> - 2.7.2-6
changelog:
  - EA-9609: Install racc and irb and require ruby-devel for update to 2.7.2
    Adjusted release to -6 in order to match ea-ruby27 package


author: Cory McIntire <cory@cpanel.net> - 2.7.8-1
changelog:
  - EA-11327: Update ea-ruby27 from v2.7.7 to v2.7.8
    CVE-2023-28755: ReDoS vulnerability in URI
    CVE-2023-28756: ReDoS vulnerability in Time


author: Cory McIntire <cory@cpanel.net> - 2.7.2-6
changelog:
  - EA-9609: Update ea-ruby27 from v2.7.1 to v2.7.2
    Adjusted release to -6 due to OBS build issues of the gems


author: Cory McIntire <cory.mcintire@webpros.com> - 2.2.13-1
changelog:
  - EA-12755: Update ea-ruby27-rubygem-rack from v2.2.12 to v2.2.13
  - CVE-2025-27610 Local file inclusion in Rack::Static.


author: Cory McIntire <cory.mcintire@webpros.com> - 2.2.18-1
changelog:
  - EA-13163: Update ea-ruby27-rubygem-rack from v2.2.17 to v2.2.18
  - CVE-2025-59830 Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion via semicolon-separated parameters.


author: Cory McIntire <cory.mcintire@webpros.com> - 2.2.19-1
changelog:
  - EA-13174: Update ea-ruby27-rubygem-rack from v2.2.18 to v2.2.19
  - CVE-2025-61772 Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
  - CVE-2025-61771 Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
  - CVE-2025-61770 Unbounded multipart preamble buffering enables DoS (memory exhaustion)


