Back to Security Advisories

EasyApache 4 25.90 — cPanel & WHM Update

EasyApache 4 release 25.90 (October 14, 2026) patches ea-libcurl for six vulnerabilities (CVE-2025-14524, CVE-2025-14819, CVE-2026-5773, CVE-2026-18924, CVE-2026-80230 and CVE-2026-80255), and also updates ea-libzip to 1.12 and ea-tomcat101 to 10.1.61. libcurl is embedded across PHP and countless applications on the server, so the package update should go out with the next maintenance window.

High 5.3 CVSS
cPanel

Affected Versions

25.90

What this means under a SharedLicense license

curl flaws typically sit in protocol handling (fetching URLs), where crafted responses or redirects can crash processes or leak memory — and since libcurl is reachable from PHP applications on every hosted site, exposure is broad even when individual scores are moderate.

EasyApache 4 25.90

2026 October 14

Security and maintenance updates

We released updated packages for EasyApache 4.

This security release patches ea-libcurl for six vulnerabilities (CVE-2025-14524, CVE-2025-14819, CVE-2026-5773, CVE-2026-18924, CVE-2026-80230 and CVE-2026-80255).

The release also updates ea-libzip to 1.12 and ea-tomcat101 to 10.1.61. ea-podman replaces its adminbin with an in-process admin module, releases reserved ports when an install fails, and stops account backups from storing container files more than once.

For a full list of changes, read the EasyApache 4 change log.

Frequently Asked Questions

What does EasyApache 4 25.90 fix?
Six libcurl vulnerabilities (CVE-2025-14524, CVE-2025-14819, CVE-2026-5773, CVE-2026-18924, CVE-2026-80230 and CVE-2026-80255) via an ea-libcurl patch. The release also updates ea-libzip to 1.12, ea-tomcat101 to 10.1.61, and reworks ea-podman (in-process admin module, port release on failed installs, no duplicate container-file backups).
Why does the list include CVE-2025-year IDs?
CVE-2025-14524 and CVE-2025-14819 are libcurl vulnerabilities disclosed in late 2025 that the bundled ea-libcurl package had not yet picked up; the 25.90 patch closes them now. Old-year CVEs in a current release note mean backported fixes, not new bugs.
How do I apply the fix?
Run yum update 'ea-*' or use WHM → EasyApache 4 → Update, then confirm the ea-libcurl package shows the 25.90-era version. Applications using curl through PHP pick up the patched library as PHP workers restart.
Is libcurl exposure serious on a hosting server?
It is broad rather than deep: virtually every PHP application can reach libcurl, so any flaw in it touches the whole server's workload. No CVSS scores were listed in the release note at publish time — check the NVD entries for the individual six before triaging further.

References

Security Advisories

Related Advisories

EasyApache 4 25.91 — cPanel & WHM Update

2026-10-21

EasyApache 4 25.92 — cPanel & WHM Update

2026-10-21

cPanel CVE-2026-110672

2026-10-19 00:00:00

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System