# changelog

author: Dan Muey <daniel.muey@webpros.com> - 2.4.64-3
changelog:
  - EA-13041: Rolling “ea-apache24” back to “35b37d6c7295199c5157c68145f220d9fa61ff02”: Apache v2.4.64 broke SNI (rando 421)


author: Cory McIntire <cory.mcintire@webpros.com> - 2.4.66-1
changelog:
  - EA-13281: Update ea-apache24 from v2.4.65 to v2.4.66
  	- low: Apache HTTP Server: mod_md (ACME), unintended retry intervals (CVE-2025-55753)
  	- low: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVE-2025-58098)
  	- moderate: Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF (CVE-2025-59775)
  	- low: Apache HTTP Server: CGI environment variable override (CVE-2025-65082)
  	- moderate: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo (CVE-2025-66200)


author: Cory McIntire <cory.mcintire@webpros.com> - 2.4.67-1
changelog:
  - EA-13423: Update ea-apache24 from v2.4.66 to v2.4.67
  	- important: Apache HTTP Server: http2: double free and possible RCE on early reset (CVE-2026-23918)
  	- moderate: Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr (CVE-2026-24072)
  	- moderate: Apache HTTP Server: mod_auth_digest timing attack (CVE-2026-33006)
  	- low: Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header() (CVE-2026-28780)
  	- low: Apache HTTP Server: mod_md unrestricted OCSP response (CVE-2026-29168)
  	- low: Apache HTTP Server: mod_dav_lock indirect lock crash (CVE-2026-29169)
  	- low: Apache HTTP Server: mod_authn_socache crash (CVE-2026-33007)
  	- low: Apache HTTP Server: multiple modules HTTP response splitting (CVE-2026-33523)
  	- low: Apache HTTP Server: off-by-one OOB reads in AJP getter functions (CVE-2026-33857)
  	- low: Apache HTTP Server: mod_proxy_ajp heap buffer over-read in ajp_msg_get_string (CVE-2026-34032)
  	- low: Apache HTTP Server: mod_proxy_ajp heap over-read in ajp_parse_data() (CVE-2026-34059)


author: Cory McIntire <cory.mcintire@webpros.com> - 2.4.67-3
changelog:
  - EA-13454: Backport mod_http2 v2.0.41 fix for CVE-2026-49975 (HTTP/2 Bomb - cookie LimitRequestFields bypass)


author: Igor Savenko <bliss@cloudlinux.com> 4.0.50-5
changelog:
  - Fixed spec file (added /opt/passenger to %files section)
  - Added pre-creating dir for apache conf files in handle_module.py


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> 5.0.26-21
changelog:
  - Rebase upon passenger-5.0.26
  - Added support for DirectAdmin
  - More robust alt-mod-passenger installation routine for CPanel servers
  - Deploy pre-built binaries for non CPanel servers
    (thus no custom httpd-devel, alt-mod-passenger depends on)
  - Use pre-built ruby native support library for all CloudLinux alt-ruby versions,
    so that the library is not built on-fly per user app first invokation


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> 5.0.29-22
changelog:
  - Rebase upon passenger-5.0.29
  - Return back to Passenger 4.0 tmp/restart.txt behavour (minimal lag
    between touching app/tmp/restart.txt and app restart)
  - Fixup installation script for non-panel server


author: Vladimir Prokofev <vprokofev@cloudlinux.com> 5.0.29-26
changelog:
  - Support httpd, httpd24 and EA4 apache with same passenger
  - New passenger version 5.0.29
  - Small bug fixes


author: Vladimir Prokofev <vprokofev@cloudlinux.com> 5.0.29-27
changelog:
  - Improve checking of the building passenger native libs.
  - Bug fix usage of have_ functions to build native libs


author: Vladimir Prokofev <vprokofev@cloudlinux.com> - 5.0.29-27.2
changelog:
  - Improve checking of the building passenger native libs.
  - Bug fix usage of have_ functions to build native libs
  - Provides ea-apache24-alt_mod_passenger package name


author: Vladimir Prokofev <vprokofev@cloudlinux.com> 5.0.30-3
changelog:
  - Check configs to migrate from 4.x to 5.x Passenger
  - Restart Passenger (via httpd) to reload fresh liblve


author: Vladimir Prokofev <vprokofev@cloudlinux.com> 5.0.30-4
changelog:
  - Install Passenger into separate version folders
  - Tune simlinks to point to proper Passenger version
  - Fix permissions of PassengerInstanceRegistryDir to 755


author: Serhii Kokhan <skokhan@cloudlinux.com> - 5.1.6-1
changelog:
  - ALMODP-77: Make /var/passenger less worldwide accessible
  - ALMODP-60: Use `PASSENGER_INSTANCE_REGISTRY_DIR` instead `PASSENGER_TEMP_DIR`
  - ALMODP-81: Add conflict for package ea-ruby24-mod_passenger


author: Serhii Kokhan <skokhan@cloudlinux.com> - 5.1.11-1
changelog:
  - ALMODP-91: Arbitrary file read vulnerability in passenger
  - ALMODP-89: Made graceful reload Apache instead of restart when alt-mod-passenger install/update
  - Remove dependency from old package which obsoletes ea-apache24-alt_mod_passenger
  - ALMODP-86: Add Node.js language support for alt-mod-passenger


author: Sergey Kokhan <skokhan@cloudlinux.com> - 5.3.7-2
changelog:
  - ALMODP-112: disable nodejs handler by default
  - ALMODP-111: allow PassengerFriendlyErrorPages PassengerAppEnv passenger directives in htaccess


author: Sergey Kokhan <skokhan@cloudlinux.com> - 5.3.7-4
changelog:
  - ALMODP-121: Removed files with 1667 uid
  - ALMODP-120: fix httpd24-alt-mod-passenger spec for new httpd24-httpd


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 5.3.7-6
changelog:
  - ALMODP-134: Fix write application custom passenger log to user's tmp under cagefs
  - ALMODP-135: Deleted writing warning to main apache log when using user's custom log


author: Sergey Kokhan <skokhan@cloudlinux.com> - 5.3.7-14
changelog:
  - ALMODP-143: httpd24-alt-mod-passenger installation paths for mod_passenger.so and mod_passenger.conf changed


author: Dan Muey <dan@cpanel.net> - 1.0-5
changelog:
  - changed indicator file from conf_dir/ea4_built to /var/cpanel/conf/is_ea4
  - bump version for release


author: Tim Mullin <tim@cpanel.net> 1.0-9
changelog:
  - Stopped autogenerating "requires" for httpd-runtime
  - Invoking restartsrv_http via a script rather than a symlink


author: Dan Muey <dan@cpanel.net> - 1.0-13
changelog:
  - Fixed 060 to not symlink conf dir (specific content already symlinked)
  - consolidated 060's mkdirs and fixed bug w/ error variable


author: Darren Mobley <darren@cpanel.net> 1.0-24
changelog:
  - Renamed 040-restartsrv_httpd.sh to 500-restartsrv_httpd.sh to fix chicken/egg problem during migration


author: Dan Muey <dan@cpanel.net> 1.0-28
changelog:
  - have PHP config hook script account for a zero PHP state: ignore needless object constructor death and remove its files


author: S. Kurt Newman <kurt.newman@cpanel.net> - 1.0.42
changelog:
  - Fixed virtual host definition ordering httpd.conf so users
    can override cpanel & whm proxy subdomains (EA-3865)


author: Joe Orton <jorton@redhat.com> - 2.2.15-3
changelog:
  - default config tweaks:
   * harden httpd.conf w.r.t. .htaccess restriction (#591293)
   * load mod_substitute, mod_version by default
   * drop proxy_ajp.conf, load mod_proxy_ajp in httpd.conf
   * add commented list of shipped-but-unloaded modules
   * bump up worker defaults a little
   * drop KeepAliveTimeout to 5 secs per upstream
  - fix LSB compliance in init script (#522074)
  - bundle NOTICE in -tools
  - use init script in logrotate postrotate to pick up PIDFILE
  - drop some old Obsoletes/Conflicts


author: Joe Orton <jorton@redhat.com> - 2.2.17-7
changelog:
  - generate dummy mod_ssl cert with CA:FALSE constraint (#667841)
  - add man page stubs for httpd.event, httpd.worker
  - drop distcache support
  - add STOP_TIMEOUT support to init script


author: Joe Orton <jorton@redhat.com> - 2.2.21-6
changelog:
  - complete conversion to systemd, drop init script (#770311)
  - fix comments in /etc/sysconfig/httpd (#771024)
  - enable PrivateTmp in service file (#781440)
  - set LANG=C in /etc/sysconfig/httpd


author: Joe Orton <jorton@redhat.com> - 2.4.1-1
changelog:
  - update to 2.4.1
  - adopt upstream default httpd.conf (almost verbatim)
  - split all LoadModules to conf.modules.d/*.conf
  - include conf.d/*.conf at end of httpd.conf
  - trim %changelog


author: Joe Orton <jorton@redhat.com> - 2.4.1-2
changelog:
  - clean docroot better
  - ship proxy, ssl directories within /var/cache/httpd
  - default config:
   * unrestricted access to (only) /var/www
   * remove (commented) Mutex, MaxRanges, ScriptSock
   * split autoindex config to conf.d/autoindex.conf
  - ship additional example configs in docdir


author: Joe Orton <jorton@redhat.com> - 2.4.1-3
changelog:
  - add mod_proxy_html subpackage (w/mod_proxy_html + mod_xml2enc)
  - move mod_ldap, mod_authnz_ldap to mod_ldap subpackage


author: Joe Orton <jorton@redhat.com> - 2.4.2-4
changelog:
  - pull from upstream:
    * use TLS close_notify alert for dummy_connection (r1326980+)
    * cleanup symbol exports (r1327036+)


author: Joe Orton <jorton@redhat.com> - 2.4.2-15
changelog:
  - move tmpfiles.d fragment into /usr/lib per new guidelines
  - package /run/httpd not /var/run/httpd
  - set runtimedir to /run/httpd likewise


author: Joe Orton <jorton@redhat.com> - 2.4.2-18
changelog:
  - avoid use of "core" GIF for a "core" directory (#168776)
  - drop use of "syslog.target" in systemd unit file


author: Joe Orton <jorton@redhat.com> - 2.4.3-7
changelog:
  - use systemd scriptlets if available (#850149)
  - don't run posttrans restart if /etc/sysconfig/httpd-disable-posttrans exists


author: Joe Orton <jorton@redhat.com> - 2.4.3-13
changelog:
  - filter mod_*.so auto-provides (thanks to rcollet)
  - pull in syslog logging fix from upstream (r1344712)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.4-5
changelog:
  - execute systemctl reload as result of apachectl graceful
  - mod_ssl: ignore SNI hints unless required by config
  - mod_cache: forward-port CacheMaxExpire "hard" option
  - mod_ssl: fall back on another module's proxy hook if mod_ssl proxy
    is not configured.


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.4-6
changelog:
  - htpasswd/htdbm: fix hash generation bug (#956344)
  - do not dump vhosts twice in httpd -S output (#928761)
  - mod_cache: fix potential crash caused by uninitialized variable (#954109)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.4-12
changelog:
  - mod_unique_id: replace use of hostname + pid with PRNG output (#976666)
  - apxs: mention -p option in manpage


author: Joe Orton <jorton@redhat.com> - 2.4.6-13
changelog:
  - mod_ssl: sanity-check use of "SSLCompression" (#1036666)
  - mod_proxy_http: fix brigade memory usage (#1040447)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-17
changelog:
  - mod_dav: add security fix for CVE-2013-6438 (#1077907)
  - mod_log_config: add security fix for CVE-2014-0098 (#1077907)


author: Jim Perrin <jperrin@centos.org> - 2.4.6-17.el7.centos.1
changelog:
  - Remove index.html, add centos-noindex.tar.gz
  - update welcome.conf with proper aliases
  - change symlink for poweredby.png


author: Trinity Quirk <trinity.quirk@cpanel.net> - 2.4.6-17.el6.cpanel.1
changelog:
  - Added cPanel-specific patches
  - Removed apache user creation, configured to run as nobody
  - Repaired incorrect run directories


author: Trinity Quirk <trinity.quirk@cpanel.net> - 2.4.6-20.el6.cpanel.1
changelog:
  - Each module now has its own conf.modules.d file
  - conf.modules.d files are created programmatically
  - Simplified ssl, proxy_html, ldap, and session package file lists


author: Trinity Quirk <trinity.quirk@cpanel.net> - 2.4.6-21.el6.cpanel.1
changelog:
  - Split the MPMs into their own packages
  - mod_heartbeat needs to be loaded after mod_status and mod_watchdog


author: S. Kurt Newman <kurt.newman@cpanel.net> - 2.4.12-10
changelog:
  - Fixed mpm conflicts
  - Removed itk conflict since apache shouldn't be concerned with that..
    only itk should be
  - Removed unused cloudlinux cagefs patch


author: Julian Brown <julian.brown@cpanel.net> - 2.4.16-2
changelog:
  - Added requirements for ea-apache24-mod_proxy and mod_proxy_http
  - so we can support proxy subdomains


author: S. Kurt Newman <kurt.newman@cpanel.net> - 2.4.16-5
changelog:
  - Added /etc/apache2/bin directory for apache-specific utility scripts
  - Added additional macros to /etc/rpm/macros.apache2 so other rpms
    can make use of those paths


author: S. Kurt Newman <kurt.newman@cpanel.net> - 2.4.18-2
changelog:
  - Applied fix for Apache Bug #58854.  This patch should be removed
    once it has made into upstream.


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1:2.4.18-2.1.cloudlinux
changelog:
  - httpd2-cagefs_jail.patch and httpd-2.4-suexec-safe.patch applied
  - Epoch bumped to 1
  - dist macro added to Release
  - Dependencies adjusted to use ea-* packages from CloudLinux OS


author: David Nielson <david.nielson@cpanel.net> 2.4.18-3
changelog:
  - Remove conflict on 'webserver' and add conflict on 'httpd-mmn' so
    Nginx can be installed from EPEL.


author: Edwin Buck <e.buck@cpanel.net> - 2.4.23-1
changelog:
  - EA-4872: Updated to verison 2.4.23
  - Added mod_proxy_hcheck (side effect of upstream 2.5 backport into 2.4.23)


author: S. Kurt Newman <kurt.newman@cpanel.net> - 2.4.23-2
changelog:
  - mod_lua can be installed, but is off by default (EA-4825)
  - fixed a few rpmlint warnings complaining about lack of attr macros


author: S. Kurt Newman <kurt.newman@cpanel.net> - 2.4.23-7
changelog:
  - Update apachectl with ulimit calls modifying the open file
    descriptor limit so that Apache will start up (EA-5662)


author: Dan Muey <dan@cpanel.net> - 2.4.23-9
changelog:
  - EA-5557: turn off icon directives by default since the icons are broken under symlink protect
  -          and are used by HTMLTable even when fancy indexinf is off


author: Jacob Perkins <jacob.perkins@cpanel.net> - 2.4.29-1
changelog:
  - Updated to version 2.4.29 via update_pkg.pl (ZC-2981)
  - Removed mod_unique_id patch as it was patched upstream.


author: Cory McIntire <cory@cpanel.net> - 2.4.29-2
changelog:
  - EA-6020: Restarting Apache while using splitlogs can result in "Broken pipe" errors
  - Applying patch provided by Gary Stanley (gary@cpanel.net)


author: Rishwanth Yeddula <rish@cpanel.net> - 2.4.29-5
changelog:
  - EA-7127: Ensure the mod_proxy_html and mod_xml2enc modules
    build against ea-libxml2. Additionally, updated the build
    process to avoid modifying the LDFLAGS - as it caused the
    libxml2 dependency to be carried to extensions compiled
    separately.


author: Rishwanth Yeddula <rish@cpanel.net> - 2.4.29-7
changelog:
  - EA-7159: Use 'elinks' instead of 'links' as a dependency
    to ensure that EA4 does not pull any packages from
    the EPEL repos.


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 2.4.33-5.cloudlinux.3
changelog:
  - EA4D-66: Remove %triggerin for ea-apache24-mod_security2 package to avoid apache
    downtime during the update


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 2.4.33-5.cloudlinux.5
changelog:
  - Reverted "EA4D-26: Add patch for extending mod_remoteip to support Host/Port/Protocol mangling natively"


author: Rishwanth Yeddula <rish@cpanel.net> - 2.4.33-6
changelog:
  - EA-7468: Ensure dependency resolution picks /usr/bin/perl instead
    of /bin/perl. This helps downstream users of our RPMs as their
    build environments can be simplified.


author: Rishwanth Yeddula <rish@cpanel.net> - 2.4.34-2
changelog:
  - EA-7715: Revert mod_ratelimit back to the 2.3.33 version.
    This is to ensure that it emits proper chunks, as there are several
    issues with the 2.3.34 version.


author: Rishwanth Yeddula <rish@cpanel.net> - 2.4.34-3
changelog:
  - EA-7802: Restore mod_ratelimit back to the 2.3.34 version. Apply
  upstream fixes for it from trunk.


author: Cory McIntire <cory@cpanel.net> - 2.4.35-1
changelog:
  - EA-7871: Update to v2.4.35, drop v2.4.34
    Remove Patch500: 0017-Apply-mod_ratelimit-fix-from-trunk.patch as it
    was implemented upstream.


author: Cory McIntire <cory@cpanel.net> - 2.4.39-1
changelog:
  - EA-8307: Update to 2.4.39, drop 2.4.38
    CVE-2019-0211: Apache HTTP Server privilege escalation from modules' scripts
    CVE-2019-0196: mod_http2, read-after-free on a string compare
    CVE-2019-0197: mod_http2, possible crash on late upgrade
    CVE-2019-0215: mod_ssl access control bypass
    CVE-2019-0217: mod_auth_digest access control bypass
    CVE-2019-0220: URL normalization inconsistincies


author: Rishwanth Yeddula <rish@cpanel.net> - 2.4.39-3
changelog:
  - CPANEL-27056: Fix bug in condition that allowed for non-user files
    to be served in certain situations when SymlinkProtection was
    enabled.


author: Daniel Muey <dan@cpanel.net> - 2.4.41-5
changelog:
  - ZC-4361: bump release prefix past 4 so these will be newest (4 was added and disappeared due to a faulty revert)


author: Cory McIntire <cory@cpanel.net> - 2.4.46-5
changelog:
  - EA-9463: Resolve Apache startup race conditions
             Enable mod_systemd for further startup enhancements


author: Travis Holloway <t.holloway@cpanel.net> - 2.4.49-2
changelog:
  - EA-10123: Patch apache 2.4.49: Correctly decrement active_daemons also in the case that the child process decides on its own to die because of MaxRequestsPerChild.


author: S. Kurt Newman <kurt.newman@cpanel.net> - 1.4-4
changelog:
  - Change bwlimited.conf to 0644 so that normal users can load modules
    the same as Apache while testing their configuration with 'httpd -t'
  - Also renamed configuration to 490_mod_bwlimited.conf to match the
    naming scheme of our other files.


author: S. Kurt Newman <kurt.newman@cpanel.net> - 2.3.9-7
changelog:
  - General cleanup (EA-5395)
  - Cleans up run/mod_fcgid directory when package is uninstalled (EA-5594)
  - Switch to rpm macros


author: Igor Seletskiy <iseletsk@piter.seletskiy.com>
changelog:
  - Ability to provide which handlers to treat as suexec, and which to treat regularly <commit: 37ad6a8d6dafd9486217f60e369c530c17510ac6>


author: Igor Seletskiy <iseletsk@piter.seletskiy.com>
changelog:
  - Fixed issue when mod_hostinglimits intercepts request already in lve (when php is done via cgi) <commit: abccd6a8276eefca2e50dcf03cfb0519fe3b6f26>


author: Alexey Berezhok <alexey_com@ukr.net>
changelog:
  - add mode -m 644 to spec file and add php-script to modhostinglimits.conf <commit: 6bf688d72a68442b2886926fba8cb19ba6a10fc7>


author: Igor Seletskiy <iseletsk@piter.seletskiy.com>
changelog:
  - Added directories/confgis to make sure mod_hostinglimits compiles under directadmin <commit: 242e320b83b167435f2b2dccb7c4d3ca045e3a42>


author: Alexey Berezhok <alexey_com@ukr.net>
changelog:
  - fix spec file's string with liblve to lve-devel. liblve - for future releases <commit: fb10d65ba6364b6ce78e70e3decbf8200b8a0be2>


author: Igor Seletskiy <iseletsk@piter.seletskiy.com>
changelog:
  - moved p_cookie to be taken from request_config, making module MPM Worker safe <commit: fdab876e8fb52f0f3a21f9fa836cc411b9d4a392>


author: Igor Seletskiy <iseletsk@piter.seletskiy.com>
changelog:
  - Merge branch 'master' of gitosis@pylesos.interdon.net:mod_hostinglimits <commit: f3b7c8df2280fa81b54c33dc53bf6d46f7cf4caa>


author: Alexey Berezhok <alexey_com@ukr.net>
changelog:
  - Fix bug when p_cookie is not installed process was fall down <commit: 44668ecf8599ee39ab8f21ae632d0e4514f67192>


author: Alexey Berezhok <alexey_com@ukr.net>
changelog:
  - Add private thread variable p-cookie instead mutex <commit: a3d7f50a59f2f94b463edfdf76f67c4a5235cfd8>


author: Alexey Berezhok <alexey_com@ukr.net>
changelog:
  - Fix bug with User and Group params. I can get it bu using server record <commit: 54be580ac5db55913a32a5cf8fb01981a671ef84>


author: Anton Volkov <avolkov@cloudlinux.com> 0.7-1
changelog:
  - [#Feature 189] AllowedHandlers and DenyHandlers directives regex support is added
    - [#Feature 191] DenyHandlers directive support is added
    - Allow to serve content on LVE re-entry(apache 1.3)


author: Alexey Berezhok <alexey_com@ukr.net> 0.7-1
changelog:
  - Add new spec file 3 rpm in 1 spec file
    - Add fix in *.cmake file for building under H-Sphere 3.1


author: Anton Volkov <avolkov@cloudlinux.com> 0.7-2
changelog:
  - Added support for new LVEErrorCode directive
    - Default LVEErrorCode is changed from 503 to 508, default error 508 page is added in module source
    - Bug fix: checking whether we are already in LVE (errno should be EPERM, not -EALREADY)
    - Bug fix: logging "already in LVE" error in module for Apache 1.3


author: Alexey Berezhok <alexey_com@ukr.net> 0.7-8
changelog:
  - Restored leave hendler                                                                                                                                    
  - Removed request pool data storing                                                                                                                         
  - Disable empty host debugging
  - Added new directive LVESitesDebug                                                                                                                         
  - Re-entry procedure restored                                                                                                                               
  - Optimized leave handler                                                                                                                                   
  - Optimized work with child pools
  - Reset errno on module initializtion
  - Repaired lve available check
  - Added support mod_ruid2                                                                                                                                   
  - Added new derctive LVEUser                                                                                                   
  - Added support of apache-mpm-itk


author: Alexey Berezhok <alexey_com@ukr.net> 0.7-15
changelog:
  - Added support new apr                                                                                                                                     
  - Removed h-sphere support. No more need


author: Alexey Berezhok <alexey_com@ukr.net> 0.8-1
changelog:
  - Added LVERetryAfter: send RetryAfter header
  - Added LVEParseMode: there are three modes of working(CONF, PATH, OWNER)
  - Added LVEPathRegexp: regexp expression for username extracting from path(PATH mode)
  - Added LVEHeaderName: not supported yet
  - Added URL with error description in log


author: Alexey Berezhok <alexey_com@ukr.net> 1.0-5
changelog:
  - Added LVEUids debug
  - Fixed bug with mod_userdir + mod_hostinglimits
  - Renew lve api for apache 1.3


author: Stefan Mortensen <stefan.mortensen@atomia.com>, Mikhail Zhbankov <mzhbankov@cloudlinux.com> 1.0-26
changelog:
  - Fixed issue where cfg->path_regex was never being set when setting a custom path with LVEPathRegexp causing the default to always be used
  - AAP-57: mod_hostinglimits not increases EP in cgi mode (but process is in LVE)


author: Eugen Vodilov <evodilov@cloudlinux.com> - 1.0-30
changelog:
  - AAP-142: avoid lve_leave using filters
  - AAP-151: add EP limit hiting when EP is reached max value


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> - 1.0-37.1
changelog:
  - AAP-273: expand the range of LVEErrorCodes
  - AAP-253: spec and cmake redesigned for new httpd24 build
  - AAP-241: Update Copyright for mod_hostinglimits project
  - AAP-244: Fix cmakefiles for httpd24-mod_hostinglimits


author: Aleksandr Demeshko <ademeshko@cloudlinux.com> Nikolay Petukhov <npetukhvov@cloulinux.com> - 1.0-40
changelog:
  - AAP-510: log level changed to WARN for limited requests
  - AAP-493: Improved log output
  - AAP-508: Allowed AllowedHandlers and DenyHandlers directives inside Directory, Location and Files contexts


author: Nika Keshelava <nkeshelava@cloudlinux.com> - 1.0-46
changelog:
  - CLOS-3754: fix SIGSEGV in process_lve_error() when mod_brotli is loaded
  - CLOS-4441: Maintenance update
  - CLOS-4585: Maintenance update


author:
  Timur Averianov <taverianov@cloudlinux.com> Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 1.1-86

changelog:
  - MAXWS-785: Fix backend termination script hanging in the background when there were too many processes
  - CLOS-3499: Update package to be compatible with CloudLinux 10


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> Timur Averianov <taverianov@cloudlinux.com> 1.1-87

changelog:
  - CLOS-3355: Set the docroot and domain information in the env before spawning lsphp
  - CLOS-3574: Use LSPHPRC instead of PHPRC if ea-php is version 8.4 and higher
  - CLOS-3646: Support RLIMITs


author: Nika Keshelava <nkeshelava@cloudlinux.com>, Serhii Kokhan <skokhan@cloudlinux.com> 1.1-93
changelog:
  - CLOS-1655: Add CRIU support for CL9 and CL10
  - CLOS-4290: Minor fixes in request parsing and configuration scripts


author: Serhii Kokhan <skokhan@cloudlinux.com> 1.1-95
changelog:
  - MAXWS-1086: Link liblscapi against the renamed criu-lve (libcriu-lve)
  - MAXWS-1084: liblsapi: export lscapi_compose_request as a public API
  - MAXWS-1074: Improve own-log-path file handling in the lsphp spawner
  - MAXWS-1075: Input-handling and file-permission fixes in liblscapi and management scripts
  - MAXWS-1085: Input-validation and error-handling fixes in request/response parsing and management scripts


changelog: - Initial MAx Cache implementation for CloudLinux
author:
  Danila Vershinin <dvershinin@cloudlinux.com>, Sandro Kalatozishvili <skalatozishvili@cloudlinux.com>, Sergey Kokhan <skokhan@cloudlinux.com> 1.0.0-1


changelog: - Initial MaxCache implementation for CloudLinux
author:
  Danila Vershinin <dvershinin@cloudlinux.com>, Sandro Kalatozishvili <skalatozishvili@cloudlinux.com>, Sergey Kokhan <skokhan@cloudlinux.com> - 1.0.0-1


author: Serhii Kokhan <skokhan@cloudlinux.com> - 1.1.0-1
changelog:
  - MAXWS-1043: Remove htcache-watchd dependency; use per-request stat() polling (RevalidateInterval=0)
  - MAXWS-1042: Rename MaxCacheHTCache* directives to MaxCacheHtaccess*; old names kept as deprecated aliases
  - MAXWS-1042: Rename htcache-status handler to maxcache-htaccess-status; old name kept as deprecated alias
  - MAXWS-1042: Rename config file maxcache_htcache.conf to maxcache_htaccess.conf with migration


author: Serhii Kokhan <skokhan@cloudlinux.com> - 1.2.0-1
changelog:
  - MAXWS-1064: Emit Vary header on cache hits when gzip or SSL variants are active; honor X-Forwarded-Proto only when explicitly trusted; bound device-detection regex matches.
  - MAXWS-1053: Improved correctness in cache-path construction and .htaccess directive merge; dynamic-array scaling for large <Directory> configurations.
  - MAXWS-1046: Match mandatory cookie names exactly (was substring); cap User-Agent version-digit parsing; assorted edge-case correctness fixes.


author: Serhii Kokhan <skokhan@cloudlinux.com> - 1.2.1-1
changelog:
  - MAXWS-1089: Make the htaccess engine lock robust so a crashed worker can't hang Apache.
  - MAXWS-1028: Fix .htaccess caching when the edition cannot be detected.
  - MAXWS-1078: Fix dynamic-cookie and query-string suffix length handling.


author: Serhii Kokhan <skokhan@cloudlinux.com> - 1.2.2-1
changelog:
  - MAXWS-1095: Fix lsphp segfaults from .htaccess php_value/php_flag handling in the maxcache htaccess cache.


author: Serhii Kokhan <skokhan@cloudlinux.com> - 1.2.3-1
changelog:
  - MAXWS-1096: Fix PATH_INFO handling in the .htaccess cache (front-controller internal-redirect loop).


author: Serhii Kokhan <skokhan@cloudlinux.com> - 1.2.4-1
changelog:
  - CLOS-5744: fix Apache-worker SIGSEGV on Passenger vhosts.
  - MAXWS-1088: align cache-path construction with the AccelerateWP plugin so cached pages are matched and served correctly, including per-user isolation for logged-in visitors and consistent query-string and long-filename handling.


author: Kees Monshouwer <km|monshouwer_com> 0.9.8-1
changelog:
  - Address reported security bug in chroot mode. Thanks to the
    "cPanel Security Team" for the discovery of this bug.
  - Improve chroot behavior in drop capability mode.


author: Cory McIntire <cory@cpanel.net> - 2.9.7-1
changelog:
  - EA-11134: Update mod_security2 from v2.9.6 to v2.9.7
  - Security impacting issues
      Fix: FILES_TMP_CONTENT may sometimes lack complete content
      [Issue #2857 - gieltje, @airween, @dune73, @martinhsv]


author: Cory McIntire <cory.mcintire@webpros.com> - 2.9.8-1
changelog:
  - EA-12853: Update ea-apache24-mod_security2 from v2.9.7 to v2.9.8
  - Remove 2 patches that were added upstream.
  	- 0003-Import-some-memory-leak-fixes-for-Mod-Security-2.9.x.patch
  	- 0004-Allow-Lua-5.4.patch
  - Add new patch for re.c to allow it to build on Ubuntu
  - Add new patch for tests on Ubuntu 20


author: Dan Muey <daniel.muey@webpros.com> - 2.9.9-1
changelog:
  - EA-12885: Update ea-apache24-mod_security2 from v2.9.8 to v2.9.9
  - Possible DoS vulnerability: CVE-2025-47947


author: Dan Muey <daniel.muey@webpros.com> - 2.9.10-1
changelog:
  - ZC-12886: Update ea-apache24-mod_security2 from v2.9.9 to v2.9.10
  - DoS vulnerability: CVE-2025-48866


author: Cory McIntire <cory.mcintire@webpros.com> - 2.9.11-1
changelog:
  - EA-12994: Update ea-apache24-mod_security2 from v2.9.10 to v2.9.11
  - prevent segmentation fault if the XML node is empty: CVE-2025-52891


author: Dan Muey <daniel.muey@webpros.com> - 2.9.12-1
changelog:
  - EA-13061: Update ea-apache24-mod_security2 from v2.9.11 to v2.9.12
  - fix: Improper error handling CVE 2025-54571


author: Jared Wright <jared.wright@webpros.com> - 1.0-123
changelog:
  - EA4-249: Add target-os package rename mapping support to ea_current_to_profile
  - EA4-249: Add ignore_deps support to package rename mappings


author: Cory McIntire <cory@cpanel.net> - 8.11.0-1
changelog:
  - EA-12523: Update libcurl from v8.10.1 to v8.11.0
  - CVE-2024-9681: HSTS subdomain overwrites parent cache entry


author: Cory McIntire <cory@cpanel.net> - 8.11.1-1
changelog:
  - EA-12607: Update ea-libcurl from v8.11.0 to v8.11.1
  - CVE-2024-11053: netrc and redirect credential leak


author: Cory McIntire <cory.mcintire@webpros.com> - 8.12.0-1
changelog:
  - EA-12678: Update ea-libcurl from v8.11.1 to v8.12.0
  - CVE-2025-0167 / CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
  - CVE-2025-0665 / CWE-1341: Multiple Releases of Same Resource or Handle
  - CVE-2025-0725 / CWE-680: Integer Overflow to Buffer Overflow


author: Cory McIntire <cory.mcintire@webpros.com> - 8.14.0-1
changelog:
  - EA-12899: Update ea-libcurl from v8.12.1 to v8.14.0
  - CVE-2025-5025: No QUIC certificate pinning with wolfSSL
  - CVE-2025-4947: QUIC certificate check skip with wolfSSL


author: Cory McIntire <cory@cpanel.net> - 8.17.0-3
changelog:
  - EA-13370: Security: backport CVE-2026-3805 (SMB use-after-free, Medium)
  - EA-13370: Security: backport CVE-2026-3783 (bearer token leak via netrc+redirect, Medium)
  - EA-13370: Security: backport CVE-2026-1965 (HTTP Negotiate connection reuse, Medium)
  - EA-13370: Security: backport CVE-2026-3784 (proxy credential reuse, Low)
  - EA-13370: Security: backport MQTT too-big-message-check (HackerOne 3508500)
  - EA-13370: Security: backport TFTP filename length check (HackerOne 3508321)


author: Cory McIntire <cory@cpanel.net> - 8.17.0-4
changelog:
  - EA-13421: Security: backport CVE-2026-5545 (HTTP Negotiate connection reuse auth check, Medium)
  - EA-13421: Security: backport CVE-2026-4873 (non-TLS STARTTLS connection reuse bypass, Low)
  - EA-13421: Security: backport CVE-2026-7168 (proxy Digest auth state leak on proxy switch, Medium)
  - EA-13421: Security: backport CVE-2026-6253 (proxy credentials not cleared on port/scheme change, Medium)
  - EA-13421: Security: backport CVE-2026-6276 (stale cookiehost on handle reuse, Low)
  - EA-13421: Security: backport CVE-2026-6429 (netrc credential leak via redirect, Medium)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.17.0-5
changelog:
  - EA-13474: Security: backport CVE-2026-8924 (trailing dot domain super cookie bypass PSL, Low)
  - EA-13474: Security: backport CVE-2026-9079 (stale proxy password on NULL userpwd, Medium)
  - EA-13474: Security: backport CVE-2026-8286 (STARTTLS connection reuse ignores TLS config, Low)
  - EA-13474: Security: backport CVE-2026-9080 (UAF after curl_easy_pause in socket callback, Low)
  - EA-13474: Security: backport CVE-2026-8927 (cross-proxy Digest auth state leak via env proxy, Medium)
  - EA-13474: Security: backport CVE-2026-10536 (HTTP/2 stream-dependency tree UAF, Low)
  - EA-13474: Security: backport CVE-2026-11564 (native CA trust persists after handle reuse, Low)
  - EA-13474: Security: backport CVE-2026-8932 (incomplete mTLS config match in conn reuse, Low)
  - EA-13474: Security: backport CVE-2026-12064 (proto-default skips SSH host verification on schemeless URLs, Low)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.17.0-6
changelog:
  - EA-13474: Security: backport CVE-2026-8458 (Negotiate connection reuse ignores CURLOPT_SERVICE_NAME, Low)
  - EA-13474: Security: backport CVE-2026-8926 (netrc returns wrong user's password on login mismatch, Low)
  - EA-13474: Security: backport CVE-2026-11586 (WebSocket auto-PONG unbounded memory allocation, Low)
  - EA-13474: Security: backport CVE-2026-11856 (cross-origin Digest auth state leak on handle reuse, Medium)


author: Cory McIntire <cory.mcintire@webpros.com> - 1.68.1-2
changelog:
  - EA-13378: Add CVE documentation for nghttp2 1.68.1
  - CVE-2026-27135: Denial of service via assertion failure due to missing state validation (CVSS 7.5)


author: Rex Dieter <rdieter@fedoraproject.org> - 0.99.0-20.20091203
changelog:
  - 20091203 snapshot
  - spec housecleaning
  - Tidy erroniously removes whitespace, causing mangled text (#481350)


author: Cory McIntire <cory@cpanel.net> - 2.13.3-2
changelog:
  - EA-12336: Rolling “ea-libxml2” back to “f77d3db2ad0957accee0eda34f1bb8bc66a9bb5c”: breaks older php-pears


author: Cory McIntire <cory.mcintire@webpros.com> - 2.13.8-1
changelog:
  - EA-12821: Update ea-libxml2 from v2.13.6 to v2.13.8
  - [CVE-2025-32415] schemas: Fix heap buffer overflow in xmlSchemaIDCFillNodeTables
  - [CVE-2025-32414] python: Read at most len/4 characters. (Maks Verver)


author: Cory McIntire <cory.mcintire@webpros.com> - 3.3.8-1
changelog:
  - EA-13308: Update ea-modsec2-rules-owasp-crs from v3.3.7 to v3.3.8
  - CVE-2026-21876: Rule 922110 only validates the LAST multipart part’s charset, allowing malicious charsets in earlier parts to bypass detection


author: EA4 Update Bot <cory.mcintire@webpros.com> - 3.3.9-1
changelog:
  - EA-13393: Update ea-modsec2-rules-owasp-crs from v3.3.8 to v3.3.9
  - CVE-2026-33691: File upload detection bypass via whitespace padding in PHP double-extension, PHP upload, and JSP file upload detection


author: Sergey Fokin <sfokin@cloudlinux.com> - 1:3.0.15-1.cloudlinux
changelog:
  - EA-13435: Update ea-modsec30 from v3.0.14 to v3.0.15
  - EA-13435: Switch pcre-devel to pcre2-devel; ModSecurity 3.0.15 requires PCRE2


author: Cory McIntire <cory.mcintire@webpros.com> - 0.0.9beta1-16
changelog:
  - EA-13435: Fix libxml2.so.16 runtime load failure introduced by ea-modsec30 3.0.15 (new SONAME)
  - EA-13435: Use ea-libxml2 on el7/el8 (BuildRequires, Requires, conditional LDFLAGS)
  - EA-13435: Add pcre2-devel and lua-devel BuildRequires for modsec 3.0.15 transitive deps
  - EA-13435: Use patchelf in install to embed ea-libxml2 path in mod_security3.so RPATH (APR libtool ignores LDFLAGS at link time)
  - EA-13435: Add undefine brp_remove_rpath to preserve embedded RPATH


author: Sergey Fokin <sfokin@cloudlinux.com> - 1:0.0.9beta1-16.cloudlinux
changelog:
  - EA-13435: Merge with cpanel 0.0.9beta1-16
  - EA-13435: Use ea-libxml2 on el7/el8, pcre2-devel, lua-devel for modsec 3.0.15
  - EA-13435: Add undefine brp_remove_rpath to preserve embedded RPATH
  - EA-13435: Exclude rhel >= 10 (ea-modsec30 not available)


author: Dan Muey <dan@cpanel.net> - 1.20.0-4
changelog:
  - EA-6638: bump release prefix to make the EA4 one newer than the typo'd-release-prefix in EA4-experimental


author: Dan Muey <daniel.muey@webpros.com> - 1.29.1-1
changelog:
  - EA-13069: Update ea-nginx from v1.26.3 to v1.29.1
  - CVE-2025-53859: A security issue in ngx_mail_smtp_module,which might allow an attacker to cause buffer over-read


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> alutsiuk <alutsiuk@cloudlinux.com> - 3:1.29.1-1.cloudlinux

changelog:
  - MAXWS-821: Fixed ea-nginx build after merge of nginx-1.29.1 version
  - MAXWS-793: Bump conflict version for max_webserver
  - MAXWS-756: Remove lsapi_check_script directive from cpanel-lsapi.conf
  - MAXWS-673: Implemented varmatch block based on precompiled action handlers


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 3:1.29.1-1.cloudlinux.1
changelog:
  - MAXWS-821: Evaluate varmatch block for access directives in the access phase
  - MAXWS-828: Added return and return_status_code directives support in varmatch block
  - MAXWS-849: Added remove_type directive support in nginx
  - MAXWS-851: Normalize varmatch regex with base= to match filenames
  - MAXWS-828: Fixed error_page usage in varmatch if defined in global context
  - MAXWS-861: Fixed regex normalization and matching under varmatch subdirs
  - MAXWS-889: Re-evaluate varmatch rules against the resolved index file URI


author: Cory McIntire <cory.mcintire@webpros.com> - 1.29.5-1
changelog:
  - EA-13333: Update ea-nginx from v1.29.4 to v1.29.5
  - Security: an attacker might inject plain text data in the response from an SSL backend (CVE-2026-1642).


author: Cory McIntire <cory.mcintire@webpros.com> - 1.29.7-1
changelog:
  - EA-13381: Update ea-nginx from v1.29.6 to v1.29.7
  - Security: buffer overflow in COPY or MOVE request handling with "alias" directive (CVE-2026-27654).
  - Security: processing of a specially crafted MP4 file by ngx_http_mp4_module on 32-bit platforms might cause a worker process crash (CVE-2026-27784).
  - Security: processing of a specially crafted MP4 file by ngx_http_mp4_module might cause a worker process crash (CVE-2026-32647).
  - Security: segmentation fault in worker process with CRAM-MD5 or APOP authentication when retry enabled (CVE-2026-27651).
  - Security: PTR DNS record injection in auth_http requests and XCLIENT command (CVE-2026-28753).
  - Security: SSL handshake succeeds despite OCSP rejecting client certificate in stream module (CVE-2026-28755).


author: Cory McIntire <cory.mcintire@webpros.com> - 1.31.0-1
changelog:
  - EA-13436: Update ea-nginx from v1.30.0 to v1.31.0
  - Security: heap buffer overflow in ngx_http_rewrite_module (CVE-2026-42945).


author: Cory McIntire <cory.mcintire@webpros.com> - 1.31.1-1
changelog:
  - EA-13448: Update ea-nginx from v1.31.0 to v1.31.1
  - Security: remote code execution via worker process memory pool handling (CVE-2026-9256).


author: EA4 Update Bot <cory.mcintire@webpros.com> - 1.31.3-1
changelog:
  - EA-13503: Update ea-nginx from v1.31.2 to v1.31.3
  - Security: heap buffer overflow when using map with regex, potentially allowing remote code execution or worker process denial of service via a crafted HTTP request (CVE-2026-42533).
  - Security: memory disclosure when using the ngx_http_slice_module (CVE-2026-60005).
  - Security: use-after-free when using the ngx_http_ssi_module (CVE-2026-56434).


author: CloudLinux <packages@cloudlinux.com> - 0.64-7
changelog:
  * Thu Apr 16 2026 Cory McIntire <cory.mcintire@webpros.com> - 0.64-7
  - EA-13411: Build against ea-nginx version v1.30.0


author: Sergey Fokin <sfokin@cloudlinux.com> - 0.65-1.cloudlinux.1
changelog:
  - EA-13468: Use %{version} for Source0/setup; drop stale module_version macro (fixes v0.64.tar.gz not found)


author: CloudLinux <packages@cloudlinux.com> - 0.39-9
changelog:
  * Thu Apr 16 2026 Cory McIntire <cory.mcintire@webpros.com> - 0.39-9
  - EA-13411: Build against ea-nginx version v1.30.0


author: Sergey Kokhan <skokhan@cloudlinux.com> - 1.0.0-1
changelog:
  - Initial NGINX MaxCache implementation for CloudLinux
  - Bit-for-bit compatible with AccelerateWP cache paths
  - Supports device detection, WebP, gzip, SSL variants
  - Query string normalization with allowed/ignored params
  - WordPress user and dynamic cookie support


author: Sergey Kokhan <skokhan@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.0.1-1
changelog:
  - Add dynamic config support via shared memory from maxcache-configd
  - NGINX dynamic mode parity with Apache


author: Serhii Kokhan <skokhan@cloudlinux.com> - 1.1.0-1
changelog:
  - MAXWS-1051: Rebuilt against ea-nginx 1.29.8.
  - Bump libmaxcache and maxcache-nginx-configd dependencies to 1.1.0.


author: Serhii Kokhan <skokhan@cloudlinux.com> - 1.2.0-1
changelog:
  - MAXWS-1065: Rebuilt against ea-nginx 1.31.0.
  - MAXWS-1064: Emit Vary header on cache hits when gzip or SSL variants are active; honor X-Forwarded-Proto only when explicitly trusted; bound device-detection regex matches.
  - MAXWS-1053: Improved correctness in cache-path construction and .htaccess directive merge; dynamic-array scaling for large <Directory> configurations.
  - MAXWS-1046: Match mandatory cookie names exactly (was substring); cap User-Agent version-digit parsing; assorted edge-case correctness fixes.


author: CloudLinux <packages@cloudlinux.com> - 0.9.6-5
changelog:
  * Thu Apr 16 2026 Cory McIntire <cory.mcintire@webpros.com> - 0.9.6-5
  - EA-13411: Build against ea-nginx version v1.30.0


author: CloudLinux <packages@cloudlinux.com> - 6.1.2-6
changelog:
  * Thu Apr 16 2026 Cory McIntire <cory.mcintire@webpros.com> - 6.1.2-6
  - EA-13411: Build against ea-nginx version v1.30.0


author: Dan Muey <dan@cpanel.net> - 16.13.1-2
changelog:
  - ZC-9571: Explicitly conflict w/ `ea-nodejs10` so that DNF does not simply downgrade it to get around the conflict


author: Cory McIntire <cory@cpanel.net> - 16.19.1-1
changelog:
  - EA-11255: Update ea-nodejs16 from v16.19.0 to v16.19.1
  - [CVE-2023-23918) Node.js Permissions policies can be bypassed via process.mainModule (High)
  - [CVE-2023-23919) Node.js OpenSSL error handling issues in nodejs crypto library (Medium)
  - [CVE-2023-23920] Node.js insecure loading of ICU data through ICU_DATA environment variable (Low)
  - [CVE-2023-23936] Fetch API in Node.js did not protect against CRLF injection in host headers (Medium)
  - [CVE-2023-24807] Regular Expression Denial of Service in Headers in Node.js fetch API (Low)


author: Cory McIntire <cory@cpanel.net> - 16.20.2-1
changelog:
  - EA-11604: Update ea-nodejs16 from v16.20.1 to v16.20.2
  	- CVE-2023-32559: Policies can be bypassed via process.binding
  	- CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire
  	- CVE-2023-32002:  Policies can be bypassed via Module.\_load
  	- OpenSSL sources upgraded upstream to latest


author: Cory McIntire <cory@cpanel.net> - 1.1.1v-1
changelog:
  - EA-11578: Update ea-openssl11 from v1.1.1u to v1.1.1v
  	- Fix excessive time spent checking DH q parameter value (CVE-2023-3817)
  	- Fix DH_check() excessive time with over sized modulus (CVE-2023-3446)


author: Cory McIntire <cory@cpanel.net> - 1.1.1w-1
changelog:
  - EA-11665: Update ea-openssl11 from v1.1.1v to v1.1.1w
  	- Fix POLY1305 MAC implementation corrupting XMM registers on Windows (CVE-2023-4807)


author: Dmitriy Popov <dpopov@cloudlinux.com> - 1.1.1w-2.tuxcare.els2
changelog:
  - CVE-2024-0727: properly accounting PKCS12 struct fields to prevent DoS
  - Extend modulus checking for parameters in existed patch for CVE-2023-5678


author: Dmitriy Popov <dpopov@cloudlinux.com> - 1.1.1w-6.tuxcare.els
changelog:
  - CVE-2026-22796: fix ASN1_TYPE type confusion in PKCS7_digest_from_attributes
    by validating type before accessing as OCTET_STRING
  - CVE-2025-69420: fix missing ASN1_TYPE validation in TS_RESP_verify_response
    for signing certificate attributes
  - CVE-2025-69421: fix NULL pointer dereference in PKCS12_item_decrypt_d2i
    by adding NULL check for oct parameter
  - CVE-2025-68160: fix heap buffer overflow in BIO_f_linebuffer when next BIO
    performs short writes
  - CVE-2025-69418: fix OCB AES-NI/HW stream path leaving trailing bytes
    unauthenticated/unencrypted by advancing pointers after stream processing
  - CVE-2025-69419: fix out-of-bounds write in OPENSSL_uni2utf8 and do_buf
    by checking return code of UTF8_putc/bmp_to_utf8
  - CVE-2026-22795: fix ASN1_TYPE validation in PKCS12 parsing (p12_kiss.c)
    and s_client.c before accessing union members


author: Dmitriy Popov <dpopov@cloudlinux.com> - 1.1.1w-7.tuxcare.els
changelog:
  - CVE-2026-28387: fix use-after-free in DANE client code by using X509_free()
    instead of OPENSSL_free() to properly release reference-counted X509 objects
  - CVE-2026-28388: fix NULL pointer dereference when processing a delta CRL
    that has a Delta CRL Indicator but lacks a CRL Number extension
  - CVE-2026-28389: fix NULL pointer dereference in CMS KeyAgreeRecipientInfo
    processing when KeyEncryptionAlgorithmIdentifier omits the optional
    parameter field, by using safe X509_ALGOR_get0() extraction
  - CVE-2026-28390: fix NULL pointer dereference in CMS KeyTransportRecipientInfo
    processing when RSA-OAEP SourceFunc parameters are missing, by using safe
    X509_ALGOR_get0() extraction and OPENSSL_memdup() for label data


author: Sergey Fokin <sfokin@cloudlinux.com> - 1.1.1w-8.tuxcare.els
changelog:
  - EA4D-871: Update ea-openssl11 from 1.1.1w-7 to 1.1.1w-8
  - CVE-2026-45447: fix heap use-after-free in PKCS7_verify() by popping and
    freeing each BIO in the p7bio chain on the error path instead of relying on
    BIO_free_all() over a chain whose tail may be owned by the caller
  - CVE-2026-34180: fix heap buffer over-read in ASN.1 content parsing by
    rejecting length values that do not fit in an int before they are passed to
    ASN1_STRING_set() and c2i_ASN1_OBJECT() from asn1_ex_c2i()
  - CVE-2026-7383: fix possible heap buffer overflow in ASN.1 multibyte string
    conversion by range-checking the BMPSTRING/UNIVERSALSTRING output size and
    the UTF-8 byte-count accumulator in ASN1_mbstring_ncopy()
  - CVE-2026-9076: fix out-of-bounds read in CMS password-based decryption by
    rejecting KEK ciphers with a block size below 4 octets in kek_unwrap_key()
  - CVE-2026-42766: fix NULL pointer dereference in CMS password-based decryption
    when the optional keyDerivationAlgorithm is absent from PasswordRecipientInfo


author: Cory McIntire <cory.mcintire@webpros.com> - 6.0.26-1
changelog:
  - EA-12725: Update ea-passenger-src from v6.0.25 to v6.0.26
    * [CVE-2025-26803] The http parser (from Passenger 6.0.21-6.0.25) was susceptible to a denial of service attack when parsing a request with an invalid HTTP method.


author: Dan Muey <daniel.muey@webpros.com> - 6.1.0-2
changelog:
  - EA4-223: Move A10 host-flag-support from Apache module that uses this src ball (that way NGINX benefits form it too w/out duplicating efforts)


author: Edwin Buck <e.buck@cpanel.net> - 0.1.0-1
changelog:
  - EA-5110: Add /usr/local/bin/php targets to php-cli
             Change /usr/bin/php targets to php-cgi


author: Dan Muey <dan@cpanel.net> - 0.2.0-5
changelog:
  - EA-6569: fix `-ea_php NN` handling to set package name
  - EA-6542: Ignore commented out MIME Types
  - EA-6543: ignore .htaccess 'mime type packages' that does not contain '-php'


author: Daniel Muey <dan@cpanel.net> - 1.0.0-1
changelog:
  - ZC-4400: rewrite to make it easier to work with and fix all the bugs
  - ZC-4425: deprecate -ea_php flag


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.1.6-24.cloudlinux.33
changelog:
  - Fix for hardened PHP
  - CVE-2023-3823: Fix external entity loading in XML without enabling by
    sanitizing libxml2 globals before parsing


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.1.6-24.cloudlinux.36
changelog:
  - Fix for hardened PHP
  - CVE-2022-31629: use stack instead of heap, check correct one var
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.1.6-24.cloudlinux.39
changelog:
  - Security fixes
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.1.6-24.cloudlinux.40
changelog:
  - Security fixes
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter


author: Sergey Fokin <sfokin@cloudlinux.com> - 1:5.1.6-24.cloudlinux.43
changelog:
  - EA4D-797: revert to use system libxml2 lib for all platforms
  - EA4D-811: remove libphp5.so from _root_httpd_moddir to fix file conflicts


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.2.17-27.cloudlinux.52
changelog:
  - Security fixes
  - CVE-2018-19935: fix null pointer dereference in imap_mail
  - CVE-2018-14883: fix int overflow leading to heap-based buffer over-read in
    exif.c
  - CVE-2018-20783: fix a buffer over-read in PHAR reading functions


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.2.17-27.cloudlinux.53
changelog:
  - Security fixes
  - CVE-2018-17082: fix cross-site scripting in apache2handler sapi
  - CVE-2018-19518: disable rsh/ssh functionality in imap to prevent argument
    Injection


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 5.2.17-27.cloudlinux.54
changelog:
  - Security fixes
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation
  - CVE-2020-7071: avoid parse_url() returning a wrong host to user


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.2.17-27.cloudlinux.55
changelog:
  - Security fixes
  - CVE-2019-9022: fix DNS response parsing
  - CVE-2019-11034: fix possible infoleak or crush caused by read past allocated
    buffer in exif_process_IFD_TAG()
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()
  - CVE-2019-9023: complete fix heap-based buffer over-read in mbstring regular
    expression functions when supplied with invalid multibyte data


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.2.17-27.cloudlinux.58
changelog:
  - Security fixes
  - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large
    XML namespace prefix
  - CVE-2025-1220: fix null byte termination in hostnames


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 5.2.17-27.cloudlinux.60
changelog:
  - EA4D-789: Add missing CVE patches from alt-php52
  - CVE-2012-2688, CVE-2017-11143, CVE-2017-11145, CVE-2017-11146
  - CVE-2017-7890, CVE-2017-9224, CVE-2017-9226, CVE-2017-9227
  - CVE-2017-9228, CVE-2017-9229
  - CVE-2019-19246, CVE-2021-21704


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:5.2.17-27.cloudlinux.65
changelog:
  - ELS-2599: Sync CVE patches from alt-php52
  - CVE-2012-0057, CVE-2012-0789, CVE-2013-4113, CVE-2014-2497,
    CVE-2014-3515, CVE-2014-4721, CVE-2014-9709, CVE-2015-0232,
    CVE-2016-5385, CVE-2026-6722, CVE-2026-7261, CVE-2026-7262


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1:5.2.17-2
changelog:
  - add HardenedPHP patches:
  -   security bug 73452: Segfault (Regression for #69152)
  -   security bug 73631: Invalid read when wddx decodes empty boolean element
  - ALTPHP-271: Fixed bug 71465: PHAR doesn't know about litespeed


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1:5.2.17-6
changelog:
  - add HaredenedPHP patches:
  -   bug 73764: Crash while loading hostile phar archive (CVE-2016-10159)
  -   bug 73768: Memory corruption when loading hostile phar (CVE-2016-10160)
  -   bug 73825: Heap out of bounds read on unserialize in finish_nested_data() (CVE-2016-10161)
  -   bug 68447: grapheme_extract take an extra trailing character
  -   bug 73737: FPE when parsing a tag format (CVE-2016-10158)
  -   bug 73773: Seg fault when loading hostile phar
  -   bug 73868: Fix DOS vulnerability in gdImageCreateFromGd2Ctx()
  -   bug 73869: Signed Integer Overflow gd_io.c


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1:5.2.17-8
changelog:
  - add HaredenedPHP patches:
  -   Improve check for :memory: pseudo-filename in SQlite (CVE-2012-3365)
  -   bug 70081: SoapClient info leak / null pointer dereference via multiple type confusions (CVE-2015-8835)
  -   Added check that soap.wsdl_cache_dir conforms to open_basedir (CVE-2013-1635)
  -   bug 70350: ZipArchive::extractTo allows for directory traversal when creating directories (CVE-2014-9767)
  -   Disabled external entities loading (CVE-2013-1643, CVE-2013-1824)
  -   bug 72627: Memory Leakage In exif_process_IFD_in_TIFF (CVE-2016-7128)
  - EA-5807: enable php-tidy on rhel 6 and above
  - EA-5946: force requirement of ea-libtidy instead of .so from BuildRequires ea-libtidy-devel


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1:5.2.17-9
changelog:
  - EA-2422: use ea-libcurl instead of system curl package
  - Disabled automatic Requires generation for curl subpackage


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.2.17-14.cloudlinux
changelog:
  - add require for ea-libnghttp2
  - EA-6484: Clarify Summary and Description for DSO
  - EA-6232: Build -curl with HTTP/2 support
  - Added ea-php52 symlinks to /usr/bin and /usr/local/bin


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.2.17-15.cloudlinux
changelog:
  - add HardenedPHP patches:
  - CVE-2017-11143: wddx parsing empty boolean tag leads to SIGSEGV
  - CVE-2017-11144: negative-size-param (-1) in memcpy in zif_openssl_seal()
  - CVE-2017-11145: wddx_deserialize() heap out-of-bound read via php_parse_date()
  - CVE-2017-11146: wddx_deserialize() heap out-of-bound read via php_parse_date() (caused by CVE-2017-11145)
  - CVE-2017-7890: Buffer over-read into uninitialized memory
  - CVE-2017-9224: Buffer Overflow in match_at() (Oniguruma issue)
  - CVE-2017-9226: Heap corruption in next_state_val() in 15 encodings (Oniguruma issue)
  - CVE-2017-9227: Bug in mbc_enc_len() (Oniguruma issue)
  - CVE-2017-9228: Heap corruption in next_state_val() due to uninitialized local variable (Oniguruma issue)
  - CVE-2017-9229: SIGSEGV in left_adjust_char_head() due to bad dereference (Oniguruma issue)
  - bug70436: Use After Free Vulnerability in unserialize()
  - bug74603: PHP INI Parsing Stack Buffer Overflow Vulnerability
  -
  - add LSAPI patches:
  - update Litespeed SAPI to 6.11
  - ALTPHP-351: make lsphp error messaqges more informative
  - ALTPHP-354: SIGCHILD handler fix after CRIU restoring


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 5.2.17-19.cloudlinux
changelog:
  - bug 75571: Potential infinite loop in gdImageCreateFromGifCtx
  - bug 74782: Reflected XSS in .phar 404 page


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 5.2.17-22.cloudlinux
changelog:
  - ZC-3552: Added versioning to ea-openssl and libcurl requirements.
  - ZC-3475: Update for ea-openssl shared object


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.2.17-26.cloudlinux.3
changelog:
  - Fix bug #77242: heap out of bounds read in xmlrpc_decode()
  - Fix bug #77247: heap buffer overflow in phar_detect_phar_fname_ext
  - Fix bug #77270: imagecolormatch Out Of Bounds Write on Heap
  - Fix bug #77371: heap buffer overflow in mb regex functions - compile_string_node
  - Fix bug #77380: Global out of bounds read in xmlrpc base64 code


author: S. Kurt Newman <kurt.newman@cpanel.net> - 4.7.5-5
changelog:
  - Added scl_package_override macro to regain access to global
    PHP macros that contain location and verison information.


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 5.3.29-29.cloudlinux.53
changelog:
  - Security fixes
  - CVE-2020-7068: fix using of freed hash key in the phar_parse_zipfile function
  - CVE-2020-7071: avoid parse_url() returning a wrong host to user


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.3.29-29.cloudlinux.54
changelog:
  - Security fixes
  - CVE-2018-14883: fix int overflow leading to heap-based buffer over-read in
    exif.c
  - CVE-2018-20783: fix a buffer over-read in PHAR reading functions
  - CVE-2018-19935: fix null pointer dereference in imap_mail


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.3.29-29.cloudlinux.55
changelog:
  - Security fixes
  - CVE-2018-17082: fix cross-site scripting in apache2handler sapi
  - CVE-2018-19518: disable rsh/ssh functionality in imap to prevent argument
    injection


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 5.3.29-29.cloudlinux.56
changelog:
  - Security fixes
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.3.29-29.cloudlinux.57
changelog:
  - Security fixes
  - CVE-2019-9022: fix DNS response parsing
  - CVE-2019-11034: fix possible infoleak or crush caused by read past allocated
    buffer in exif_process_IFD_TAG()
  - CVE-2019-11036: fix infoleak of crash via read past allocated buffer in
    exif_process_IFD_TAG()
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()
  - CVE-2019-9023: complete fix heap-based buffer over-read in mbstring regular
    expression functions when supplied with invalid multibyte data


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 5.3.29-29.cloudlinux.62
changelog:
  - EA4D-789: Add missing CVE patches from alt-php53
  - CVE-2016-7478, CVE-2019-19246
  - CVE-2019-11035, CVE-2021-21704, CVE-2017-11143, CVE-2017-11145
  - CVE-2017-11146, CVE-2017-7890, CVE-2017-9224, CVE-2017-9226
  - CVE-2017-9227, CVE-2017-9228, CVE-2017-9229
  - EA4D-793: Update php-fpm LVE patch


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:5.3.29-29.cloudlinux.67
changelog:
  - ELS-2599: Sync CVE patches from alt-php53
  - CVE-2013-7345, CVE-2014-1943, CVE-2014-3538, CVE-2015-4604,
    CVE-2016-5385, CVE-2026-14355, CVE-2026-6722, CVE-2026-6735,
    CVE-2026-7261, CVE-2026-7262


author: Remi Collet <rcollet@redhat.com> 1.1-4
changelog:
  - avoid empty debuginfo subpackage
  - add LICENSE, README and php54.7 man page #1061454
  - add scldevel subpackage #1063356


author: Kaj J. Niemi <kajtzu@fi.basen.net> 0:2002e-0.1
changelog:
  - c-client 2002e is based on imap-2002d
  - Build shared version, build logic is copied from FreeBSD net/cclient


author: Joe Orton <jorton@redhat.com> 2002e-3
changelog:
  - install .so with permissions 0755
  - make auth_md5.c functions static to avoid symbol conflicts
  - remove Epoch: 0


author: Kaj J. Niemi <kajtzu@fi.basen.net> 2002e-4
changelog:
  - Use CFLAGS (and RPM_OPT_FLAGS) during the compilation
  - Build the .so through gcc instead of directly calling ld


author: Rex Dieter <rexdieter at sf.net> 2004-0.fdr.1
changelog:
  - imap-2004
  - use mlock, if available.
  - Since libc-client is an attrocious name choice, we'll trump it,
    and provide imap, imap-libs, imap-devel instead (redhat bug #120873)


author: Rex Dieter <rexdieter at sf.net> 1:2004-0.fdr.6.a
changelog:
  - remove Obsoletes/Provides: libc-client (they can, in fact, co-xist)
  - -devel: remove O/P: libc-client-devel -> Conflicts: libc-client-devel


author: Rex Dieter <rexdieter[AT]users.sf.net> 1:2004-0.fdr.9.c
changelog:
  - imap2004c
  - -utils: dmail,mailutil,tmail
  - -libs: include mlock (so it's available for other imap clients, like pine)
  - remove extraneous patches
  - %_sysconfigdir/c-client.cf: use to set MailDir (but don't if upgrading from
    an older version (ie, if folks don't want/expect a change in behavior)


author: Rex Dieter <rexdieter[AT]users.sf.net> 1:2004-0.fdr.11.c1
changelog:
  - change default driver from mbox to mbx
  - comply with RFC 3501 security: Unencrypted plaintext passwords are prohibited


author: Rex Dieter <rexdieter[AT]users.sf.net> 1:2004d-1
changelog:
  - 2004d
  - imap-libs -> lib%{soname}%{version} (ie, libc-client2004d), so we can
    have multiple versions (shared-lib only) installed
  - move mlock to -utils.
  - revert RFC2301, locks out too many folks where SSL is unavailable


author: Rex Dieter <rexdieter[AT]users.sf.net> 2004e-1
changelog:
  - imap-2004e
  - rename: imap -> uw-imap (yay, we get to drop the Epoch)
  - sslcerts=%{_sysconfdir}/pki/tls/certs if exists, else /usr/share/ssl/certs


author: Rex Dieter <rdieter@fedoraproject.org> 2007-2
changelog:
  - Obsoletes: libc-client2006 (#429796)
  - drop libc-client hacks for parallel-installability, fun while it lasted


author: Rex Dieter <rdieter@fedoraproject.org> 2007e-13
changelog:
  - _with_system_libc_client option (el6+)
  - tight deps via %?_isa
  - drop extraneous Requires(post,postun): xinetd


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.4.45-79.cloudlinux.15
changelog:
  - Security fixes
  - CVE-2025-1220: fix null byte termination in hostnames
  - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large
    XML namespace prefix


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 5.4.45-82.cloudlinux.2
changelog:
  - EA4D-789: Add missing CVE patches from alt-php54
  - CVE-2017-11143, CVE-2017-7890
  - CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228
  - CVE-2017-9229, CVE-2019-11035, CVE-2019-19246, CVE-2021-21704
  - EA4D-793: Update php-fpm LVE patch


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:5.4.45-82.cloudlinux.7
changelog:
  - ELS-2599: Sync CVE patches from alt-php54
  - CVE-2016-5385, CVE-2026-14355, CVE-2026-6722, CVE-2026-6735,
    CVE-2026-7261, CVE-2026-7262


author: Remi Collet <rcollet@redhat.com> 1.1-5
changelog:
  - avoid empty debuginfo subpackage
  - add LICENSE, README and php55.7 man page #1061455
  - add scldevel subpackage #1063357


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.5.38-62.cloudlinux.11
changelog:
  - Security fixes
  - CVE-2019-9022: fix DNS response parsing
  - CVE-2019-11034: fix possible infoleak or crush caused by read past allocated
    buffer in exif_process_IFD_TAG()
  - CVE-2019-11036: fix infoleak of crash via read past allocated buffer in
    exif_process_IFD_TAG()
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 5.5.38-64.cloudlinux.1
changelog:
  - EA4D-789: Add missing CVE patches from alt-php55
  - CVE-2017-11143, CVE-2017-7890
  - CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228
  - CVE-2017-9229, CVE-2019-11035, CVE-2019-19246, CVE-2019-13224
  - CVE-2021-21704
  - EA4D-793: Update php-fpm LVE patch


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:5.5.38-64.cloudlinux.7
changelog:
  - ELS-2599: Sync CVE patches from alt-php55
  - CVE-2016-1283, CVE-2026-14355, CVE-2026-6722, CVE-2026-6735,
    CVE-2026-7261, CVE-2026-7262


author: Dan Muey <dan@cpanel.net> - 3.3-7
changelog:
  - EA-5028 via EA-5900: reinstate opcache conflict
  - (the obsoletes is problematic and there is a
  -   proper way to address the problem it was intended to solve)


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 1:3.3-8.cloudlinux.4
changelog:
  - Stop bundling opcache.so for PHP 5.5/5.6 to allow coexistence with php-opcache
  - Remove Conflicts with php-opcache (no longer needed without bundled opcache.so)
  - Strip invalid RPATH from ZendGuardLoader.so
  - Exclude ea-php55 and older zendguard builds on RHEL >= 9 (no devel packages available)


author: Arseniy Zolotarev <azolotarev@cloudlinux.com> - 1:5.6.40-25.cloudlinux.3
changelog:
  - EA4D-746: Update php-fpm lve patch to extract doc_root from php_admin_values
    for CageFS per-domain isolation


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:5.6.40-25.cloudlinux.14
changelog:
  - ELS-2599: Sync CVE patches from alt-php56
  - CVE-2026-14355, CVE-2026-6722, CVE-2026-6735, CVE-2026-7261,
    CVE-2026-7262


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.0.33-29.cloudlinux.9
changelog:
  - EA4D-797: revert to use system libxml2 lib for all platforms
  - EA4D-811: remove libphp7.so from _root_httpd_moddir to fix file conflicts


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:7.0.33-29.cloudlinux.13
changelog:
  - ELS-2599: Sync CVE patches from alt-php70
  - CVE-2026-14355, CVE-2026-6722, CVE-2026-6735, CVE-2026-7261,
    CVE-2026-7262, CVE-2026-7568


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.0.33-26.cloudlinux.6
changelog:
  - Security fixes
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - Bug #74960: fix heap buffer overflow via str_repeat
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.0.33-26.cloudlinux.8
changelog:
  - Security fixes
  - CVE-2017-9120: Integer overflow in mysqli_real_escape_string()
  - CVE-2017-9119: handle memory limit error during string reallocation correctly
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl
  - CVE-2020-7071: avoid parse_url() returning a wrong host to user


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.0.33-26.cloudlinux.9
changelog:
  - Security fixes
  - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.0.33-26.cloudlinux.10
changelog:
  - Security fixes
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()
  - CVE-2019-11034: fix possible infoleak or crush caused by read past allocated
    buffer in exif_process_IFD_TAG()
  - CVE-2019-11036: fix infoleak of crash via read past allocated buffer in
    exif_process_IFD_TAG()
  - CVE-2019-11035: fix potential infoleak or crash via read past allocated buffer
    in exif_iif_add_value()
  - CVE-2019-9022: fix DNS response parsing


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:7.1.33-20.cloudlinux.13
changelog:
  - ELS-2599: Sync CVE patches from alt-php71
  - CVE-2026-14355, CVE-2026-6722, CVE-2026-6735, CVE-2026-7261,
    CVE-2026-7262, CVE-2026-7568


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.1.33-17.cloudlinux.8
changelog:
  - Security fixes
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl
  - CVE-2017-8923: fix integer overflow when concatenating strings
  - CVE-2017-9120: Integer overflow in mysqli_real_escape_string()
  - CVE-2017-9119: handle memory limit error during string reallocation correctly
  - CVE-2020-7071: avoid parse_url() returning a wrong host to user


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.1.33-17.cloudlinux.9
changelog:
  - Security fixes
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation
  - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.1.33-17.cloudlinux.10
changelog:
  - Security fixes
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 7.2.34-12.cloudlinux.6
changelog:
  - EA4D-789: Security fixes
  - CVE-2025-14178: fix integer overflow in array_merge (ext/standard/array.c)


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 1:7.2.34-12.cloudlinux.11
changelog:
  - ALTPHP-2422: Disable OPcache SCCP pass (bit 0x80) in default optimization_level
    to avoid runtime infinite loop caused by SCCP+DFA miscompilation
    (e.g. WordPress wp_replace_in_html_tags on CloudLinux 10 + cPanel)


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:7.2.34-12.cloudlinux.14
changelog:
  - ELS-2599: Sync CVE patches from alt-php72
  - CVE-2026-14355, CVE-2026-6722, CVE-2026-6735, CVE-2026-7261,
    CVE-2026-7262, CVE-2026-7568


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.2.34-9.cloudlinux.5
changelog:
  - Security fixes
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - Bug #74267: fix segfault with streams and invalid datas
  - Bug #74960: fix heap buffer overflow via str_repeat
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.2.34-9.cloudlinux.7
changelog:
  - Security fixes
  - CVE-2017-8923: fix integer overflow when concatenating strings
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl
  - CVE-2017-9119: handle memory limit error during string reallocation correctly
  - CVE-2017-9120: integer overflow in mysqli_real_escape_string()


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.2.34-9.cloudlinux.9
changelog:
  - Security fixes
  - CVE-2019-19246: fix heap-based buffer over-read in str_lower_case_match in
    regexec.c
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 1:7.3.33-15.cloudlinux.6
changelog:
  - EA4D-789: Security fixes
  - CVE-2025-14178: fix integer overflow in array_merge (ext/standard/array.c)
  - CVE-2025-1736: fix for PHP SOAP extension


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 1:7.3.33-15.cloudlinux.12
changelog:
  - CLOS-4167: Add per-domain site isolation support to LiteSpeed SAPI; updated DEB LiteSpeed SAPI source to 8.3


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:7.3.33-15.cloudlinux.14
changelog:
  - ELS-2599: Sync CVE patches from alt-php73
  - CVE-2026-14355, CVE-2026-6722, CVE-2026-6735, CVE-2026-7261,
    CVE-2026-7262, CVE-2026-7568


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.3.33-13.cloudlinux.7
changelog:
  - EA4D-789: Security fixes
  - CVE-2025-1220: fix null byte termination in hostnames
  - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large
    XML namespace prefix


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.3.33-13.cloudlinux.1
changelog:
  - Security fixes
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.3.33-13.cloudlinux.2
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - Bug #74960: fix heap buffer overflow via str_repeat
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.3.33-13.cloudlinux.4
changelog:
  - Security fixes
  - CVE-2017-8923: fix integer overflow when concatenating strings
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl


author: Cory McIntire <cory@cpanel.net> - 7.3.3-1
changelog:
  - Updated to version 7.3.3 via update_pkg.pl (EA-8275)
  - Added patch for phpize to handle autotools on C6


author: Darya Malyavkina <dmalyavkina@cloudlinux.com> - 7.3.5-2.cloudlinux.1
changelog:
  - Apply mod_lsapi_mode patch
  - Update userini_homedir.patch, log.patch, use_reject.patch to latest versions


author: Darya Malyavkina <dmalyavkina@cloudlinux.com> - 7.3.20-2.cloudlinux.1
changelog:
  - MODLS-741: Make LSCRIU log messages with timestamps
  - MODLS-804: Improve mod_lsapi & lsphp error reporting in case of php memory limit reached


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.4.33-18.cloudlinux.6
changelog:
  - EA4D-797: revert to use system libxml2 lib for all platforms
  - EA4D-808: fix Provides field in debian/control to use exact versions
  - EA4D-811: remove libphp7.so from _root_httpd_moddir to fix file conflicts


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:7.4.33-18.cloudlinux.10
changelog:
  - ELS-2599: Sync CVE patches from alt-php74
  - CVE-2026-14355, CVE-2026-6722, CVE-2026-6735, CVE-2026-7261,
    CVE-2026-7262, CVE-2026-7568


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 7.4.33-13.cloudlinux.5
changelog:
  - EA4D-789: Security fixes
  - CVE-2024-11235: use-after-free for ??= due to incorrect live-range calculation


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 1:8.0.30-9.cloudlinux.4
changelog:
  - EA4D-789: Security fixes
  - CVE-2024-5458: filter_var URL validation fix
  - CVE-2024-8925: multipart form data parsing fix
  - CVE-2024-8927: cgi.force_redirect configuration bypass
  - CVE-2024-9026: error log parsing fix
  - CVE-2025-14178: integer overflow in array_merge


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 1:8.0.30-9.cloudlinux.8
changelog:
  - CLOS-4167: Add per-domain site isolation support to LiteSpeed SAPI; updated LiteSpeed SAPI source to 8.3


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:8.0.30-9.cloudlinux.10
changelog:
  - ELS-2599: Sync CVE patches from alt-php80
  - CVE-2025-14179, CVE-2026-14355, CVE-2026-6722, CVE-2026-6735,
    CVE-2026-7259, CVE-2026-7261, CVE-2026-7262, CVE-2026-7568


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 8.0.30-8.cloudlinux.3
changelog:
  - EA4D-789: Security fixes
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation
  - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 8.0.30-8.cloudlinux.4
changelog:
  - EA4D-789: Security fixes
  - CVE-2024-11235: use-after-free for ??= due to incorrect live-range
    calculation


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 8.0.30-8.cloudlinux.6
changelog:
  - EA4D-789: Security fixes
  - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large
    XML namespace prefix
  - CVE-2025-1220: fix null byte termination in hostnames


author: Eduard Abdullin <eabdullin@cloudlinux.con> - 8.0.0-2.cloudlinux.1
changelog:
  - Fix patch 0007 with cloudlinux-php-fpm patch
  - AAP-178: Added disable killing of PHP-FPM parent process in LVE when not enough of memory


author: Eduard Abdullin <eabdullin@cloudlinux.com> - 8.0.3-2.cloudlinux.1
changelog:
  - remove 0005-Ensure-that-php.d-is-not-scanned-when-PHPRC-is-set.patch for EA4D-265
  - Update litespeed log patch for litespeed-7.9


author: Cory McIntire <cory.mcintire@webpros.com> - 8.1.32-1
changelog:
  - EA-12766: Update ea-php81 from v8.1.31 to v8.1.32
      - Fixed GHSA-hgf54-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
      - Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
      - Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
      - Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
      - Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header when requesting a redirected resource). (CVE-2025-1219)
      - Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown causes Use-After-Free). (CVE-2024-11235)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.1.33-1
changelog:
  - EA-13001: Update ea-php81 from v8.1.32 to v8.1.33
  	- Fixed GHSA-hrwm-9436-5mv3 (pgsql extension does not check for errors during escaping). (CVE-2025-1735)
  	- Fixed GHSA-453j-q27h-5p8x (NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix). (CVE-2025-6491)
  	- Fixed GHSA-3cr5-j632-f35r (Null byte termination in hostnames). (CVE-2025-1220)


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 1:8.1.34-1.cloudlinux
changelog:
  - EA4D-789: Update ea-php81 from v8.1.33 to v8.1.34
  - Fixed CVE-2025-14177
  - Fixed CVE-2025-14178: integer overflow in array_merge
  - Fixed CVE-2025-14180
  - EA4D-793: Update php-fpm LVE patch


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:8.1.34-1.cloudlinux.7
changelog:
  - ELS-2599: Sync CVE patches from alt-php81
  - CVE-2025-14179, CVE-2026-14355, CVE-2026-6722, CVE-2026-6735,
    CVE-2026-7259, CVE-2026-7261, CVE-2026-7262, CVE-2026-7568


author: Cory McIntire <cory@cpanel.net> - 8.2.26-1
changelog:
  - EA-12577: Update ea-php82 from v8.2.25 to v8.2.26
  - (Single byte overread with convert.quoted-printable-decode filter). (CVE-2024-11233)
  - (Configuring a proxy in a stream context might allow for CRLF injection in URIs). (CVE-2024-11234)
  - (Integer overflow in the dblib quoter causing OOB writes). (CVE-2024-11236)
  - (Integer overflow in the firebird quoter causing OOB writes). (CVE-2024-11236)
  - (Leak partial content of the heap through heap buffer over-read). (CVE-2024-8929)
  - (OOB access in ldap_escape). (CVE-2024-8932)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.2.28-1
changelog:
  - EA-12772: Update ea-php82 from v8.2.27 to v8.2.28
      - Fixed GHSA-hgf54-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
      - Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
      - Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
      - Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
      - Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header when requesting a redirected resource). (CVE-2025-1219)
      - Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown causes Use-After-Free). (CVE-2024-11235)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.2.29-1
changelog:
  - EA-12996: Update ea-php82 from v8.2.28 to v8.2.29
  - Fixed GHSA-3cr5-j632-f35r (Null byte termination in hostnames). (CVE-2025-1220)
  - Fixed GHSA-453j-q27h-5p8x (NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix). (CVE-2025-6491)
  - Fixed GHSA-hrwm-9436-5mv3 (pgsql extension does not check for errors during escaping). (CVE-2025-1735)


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 1:8.2.30-1.cloudlinux
changelog:
  - EA4D-789: Update ea-php82 from v8.2.29 to v8.2.30
  - Fixed CVE-2025-14177
  - Fixed CVE-2025-14178: integer overflow in array_merge
  - Fixed CVE-2025-14180
  - EA4D-793: Update php-fpm LVE patch


author: Sergey Fokin <sfokin@cloudlinux.com> - 1:8.2.31-1.cloudlinux
changelog:
  - EA4D-837: Update ea-php82 from v8.2.30 to v8.2.31
  - Fixed GHSA-7qg2-v9fj-4mwv (XSS within FPM status endpoint). (CVE-2026-6735)
  - Fixed GHSA-wm6j-2649-pv75 (Null pointer dereference in mb_ereg_search_init()). (CVE-2026-7259)
  - Fixed GHSA-w476-322c-wpvm (SQL injection via NUL bytes in PDO_Firebird). (CVE-2025-14179)
  - Fixed GHSA-85c2-q967-79q5 (Stale SOAP_GLOBAL ref_map pointer). (CVE-2026-6722)
  - Fixed GHSA-m33r-qmcv-p97q (Use-after-free in SOAP persistence session). (CVE-2026-7261)
  - Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check in SOAP). (CVE-2026-7262)
  - Fixed GHSA-96wq-48vp-hh57 (Signed integer overflow of char array offset). (CVE-2026-7568)
  - Fixed GHSA-m8rr-4c36-8gq4 (Unsigned char handling in ctype.h functions). (CVE-2026-7258)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.2.31-1
changelog:
  - EA-13427: Update ea-php82 from v8.2.30 to v8.2.31
  - Fixed GHSA-7qg2-v9fj-4mwv (XSS within FPM status endpoint). (CVE-2026-6735)
  - Fixed GHSA-wm6j-2649-pv75 (Null pointer dereference in mb_ereg_search_init()). (CVE-2026-7259)
  - Fixed GHSA-w476-322c-wpvm (SQL injection via NUL bytes in PDO_Firebird). (CVE-2025-14179)
  - Fixed GHSA-85c2-q967-79q5 (Stale SOAP_GLOBAL ref_map pointer). (CVE-2026-6722)
  - Fixed GHSA-m33r-qmcv-p97q (Use-after-free in SOAP persistence session). (CVE-2026-7261)
  - Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check in SOAP). (CVE-2026-7262)
  - Fixed GHSA-96wq-48vp-hh57 (Signed integer overflow of char array offset). (CVE-2026-7568)
  - Fixed GHSA-m8rr-4c36-8gq4 (Unsigned char handling in ctype.h functions). (CVE-2026-7258)


author: EA4 Update Bot <cory.mcintire@webpros.com> - 8.2.32-1
changelog:
  - EA-13482: Update ea-php82 from v8.2.31 to v8.2.32
  - Fixed bug GH-22187 (Memory corruption in openssl_encrypt with AES-WRAP-PAD). (CVE-2026-14355)


author: Dan Muey <daniel.muey@webpros.com> - 8.3.29-1
changelog:
  - EA-13295: Update ea-php83 from v8.3.28 to v8.3.29
  - Fixed GHSA-8xr5-qppj-gvwj (PDO quoting result null deref). (CVE-2025-14180)
  - Fixed GHSA-h96m-rvf9-jgm2 (Heap buffer overflow in array_merge()). (CVE-2025-14178)
  - Fixed GHSA-3237-qqm7-mfv7 (Information Leak of Memory in getimagesize). (CVE-2025-14177)


author: Ilya Voyskovsky <ivoyskovsky@@cloudlinux.com> - 8.3.30-1.cloudlinux.5
changelog:
  - EA4D-806: Fix litespeed patches
  - ALTPHP-2369: Add LVD (Light Virtual Domain) support to fpm patches


author: Sergey Fokin <sfokin@cloudlinux.com> - 1:8.3.31-1.cloudlinux
changelog:
  - EA4D-837: Update ea-php83 from v8.3.30 to v8.3.31
  - Fixed GHSA-7qg2-v9fj-4mwv (XSS within FPM status endpoint). (CVE-2026-6735)
  - Fixed GHSA-wm6j-2649-pv75 (Null pointer dereference in mb_ereg_search_init()). (CVE-2026-7259)
  - Fixed GHSA-w476-322c-wpvm (SQL injection via NUL bytes in PDO_Firebird). (CVE-2025-14179)
  - Fixed GHSA-85c2-q967-79q5 (Stale SOAP_GLOBAL ref_map pointer). (CVE-2026-6722)
  - Fixed GHSA-m33r-qmcv-p97q (Use-after-free in SOAP persistence session). (CVE-2026-7261)
  - Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check in SOAP). (CVE-2026-7262)
  - Fixed GHSA-96wq-48vp-hh57 (Signed integer overflow of char array offset). (CVE-2026-7568)
  - Fixed GHSA-m8rr-4c36-8gq4 (Unsigned char handling in ctype.h functions). (CVE-2026-7258)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.3.31-1
changelog:
  - EA-13428: Update ea-php83 from v8.3.30 to v8.3.31
  - Fixed GHSA-7qg2-v9fj-4mwv (XSS within FPM status endpoint). (CVE-2026-6735)
  - Fixed GHSA-wm6j-2649-pv75 (Null pointer dereference in mb_ereg_search_init()). (CVE-2026-7259)
  - Fixed GHSA-w476-322c-wpvm (SQL injection via NUL bytes in PDO_Firebird). (CVE-2025-14179)
  - Fixed GHSA-85c2-q967-79q5 (Stale SOAP_GLOBAL ref_map pointer). (CVE-2026-6722)
  - Fixed GHSA-m33r-qmcv-p97q (Use-after-free in SOAP persistence session). (CVE-2026-7261)
  - Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check in SOAP). (CVE-2026-7262)
  - Fixed GHSA-96wq-48vp-hh57 (Signed integer overflow of char array offset). (CVE-2026-7568)
  - Fixed GHSA-m8rr-4c36-8gq4 (Unsigned char handling in ctype.h functions). (CVE-2026-7258)


author: EA4 Update Bot <cory.mcintire@webpros.com> - 8.3.32-1
changelog:
  - EA-13483: Update ea-php83 from v8.3.31 to v8.3.32
  - Fixed bug GH-21468 (TLS setup failure leading to remote DoS). (CVE-2026-12184)
  - Fixed bug GH-22187 (Memory corruption in openssl_encrypt with AES-WRAP-PAD). (CVE-2026-14355)


author: Dan Muey <daniel.muey@webpros.com> - 4:1.0-74
changelog:
  - EA4-204: Update “allphp allphp-opcache default default-nginx mpm_itk worker”
    profile(s):  add “ea-php83” based on “ea-php81”


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 4:1.0-75.cloudlinux.1
changelog:
  - EA4D-845: Extend ea-php80/83/84/85 coverage across all CL10 profiles
    (allphp, allphp-opcache, allphp_lsapi, allphp-opcache_lsapi, default,
    default_lsapi, default-nginx, default_passenger, worker — both clshared
    and clsolo). Brings CL10 to parity with CL9 which already covers all
    modern PHP versions. ea-php84/85 omit php-imap and php-pspell since
    upstream PHP no longer ships them; ea-php85 also omits php-opcache
    (not built for 8.5 on CL10).


author: Cory McIntire <cory@cpanel.net> - 6.2.14-1
changelog:
  - EA-11922: Update ea-redis62 from v6.2.8 to v6.2.14
  - CVE-2023-45145 ( Bypass permissions on socket on startups )
  - CVE-2022-24834 ( RCE )
  - CVE-2023-28856 ( Users can crash redis with invalid data )
  - CVE-2023-25155 ( Integer overflow can cause redis to terminate )
  - CVE-2022-36021 ( DoS - can cause redis to hang and consume 100% CPU time )
  - CVE-2022-35977, CVE-2023-22458 ( integer overflow issues / oom panic fixes )


author: Cory McIntire <cory@cpanel.net> - 6.2.16-1
changelog:
  - EA-12449: Update ea-redis62 from v6.2.14 to v6.2.16
  - (CVE-2024-31449) Lua library commands may lead to stack overflow and potential RCE.
  - (CVE-2024-31228) Potential Denial-of-service due to unbounded pattern matching.


author: Cory McIntire <cory@cpanel.net> - 6.2.17-1
changelog:
  - EA-12624: Update ea-redis62 from v6.2.16 to v6.2.17
  - (CVE-2024-46981) Lua script commands may lead to remote code execution


author: Cory McIntire <cory.mcintire@webpros.com> - 6.2.19-1
changelog:
  - EA-13003: Update ea-redis62 from v6.2.18 to v6.2.19
  - (CVE-2025-32023) Fix out-of-bounds write in HyperLogLog commands
  - (CVE-2025-48367) Retry accepting other connections even if the accepted connection reports an error


author: Cory McIntire <cory.mcintire@webpros.com> - 6.2.20-1
changelog:
  - EA-13172: Update ea-redis62 from v6.2.19 to v6.2.20
  - CVE-2025-49844: Lua script may lead to remote code execution
  - CVE-2025-46817: Lua script may lead to integer overflow and potential RCE
  - CVE-2025-46818: Lua script can be executed in context of another user
  - CVE-2025-46819: LUA out-of-bound read


author: Rishwanth Yeddula <rish@cpanel.net> - 5.1.8-2
changelog:
  - SEC-312: Stop reading the 'REVISION' file. This addresses an
    arbitrary file read vulnerability in passenger.


author: Daniel Muey <dan@cpanel.net> - 5.3.5-3
changelog:
  - ZC-4661: Make nodejs a requirement so that if they get one they get all of them, that way Application Manager has all the bells


author: Daniel Muey <dan@cpanel.net> - 6.0.7-2
changelog:
  - ZC-7655: Provide/Conflict `apache24-passenger`
  - ZC-7897: Add version/package specific template file (and support userdata paths like nginx)


author: Travis Holloway <t.holloway@cpanel.net> - 2.7.2-6
changelog:
  - EA-9609: Install racc and irb and require ruby-devel for update to 2.7.2
    Adjusted release to -6 in order to match ea-ruby27 package


author: Cory McIntire <cory@cpanel.net> - 2.7.8-1
changelog:
  - EA-11327: Update ea-ruby27 from v2.7.7 to v2.7.8
    CVE-2023-28755: ReDoS vulnerability in URI
    CVE-2023-28756: ReDoS vulnerability in Time


author: Cory McIntire <cory@cpanel.net> - 2.7.2-6
changelog:
  - EA-9609: Update ea-ruby27 from v2.7.1 to v2.7.2
    Adjusted release to -6 due to OBS build issues of the gems


author: Cory McIntire <cory.mcintire@webpros.com> - 2.2.13-1
changelog:
  - EA-12755: Update ea-ruby27-rubygem-rack from v2.2.12 to v2.2.13
  - CVE-2025-27610 Local file inclusion in Rack::Static.


author: Cory McIntire <cory.mcintire@webpros.com> - 2.2.18-1
changelog:
  - EA-13163: Update ea-ruby27-rubygem-rack from v2.2.17 to v2.2.18
  - CVE-2025-59830 Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion via semicolon-separated parameters.


author: Cory McIntire <cory.mcintire@webpros.com> - 2.2.19-1
changelog:
  - EA-13174: Update ea-ruby27-rubygem-rack from v2.2.18 to v2.2.19
  - CVE-2025-61772 Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
  - CVE-2025-61771 Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
  - CVE-2025-61770 Unbounded multipart preamble buffering enables DoS (memory exhaustion)


author: EA4 Update Bot <cory.mcintire@webpros.com> - 2.2.23-1
changelog:
  - EA-13397: Update ea-ruby27-rubygem-rack from v2.2.22 to v2.2.23
  - CVE-2026-34830: Regex injection via X-Accel-Mapping header in Rack::Sendfile allows attacker to control nginx X-Accel-Redirect response header
  - CVE-2026-34785: Information disclosure in Rack::Static via partial string comparison allows access to files sharing a prefix with configured static dirs


author: EA4 Update Bot <cory.mcintire@webpros.com> - 2.2.24-1
changelog:
  - EA-13530: Update ea-ruby27-rubygem-rack from v2.2.23 to v2.2.24
  - CVE-2026-26962: Improper unfolding of folded multipart headers preserves CRLF in parsed parameter values


author: Alexey Berezhok <alexey_com@ukr.net> 0.7-8
changelog:
  - Restored leave hendler
  - Removed request pool data storing
  - Disable empty host debugging
  - Added new directive LVESitesDebug
  - Re-entry procedure restored
  - Optimized leave handler
  - Optimized work with child pools
  - Reset errno on module initializtion
  - Repaired lve available check
  - Added support mod_ruid2
  - Added new derctive LVEUser
  - Added support of apache-mpm-itk


