Back to Security Advisories

Security Advisory: CloudLinux $HTTP_HOST Environment Injection

This is a security release for CloudLinux 7, CloudLinux 9. Update the product on every affected server to the patched release — there is no workaround, and unpatched servers remain exposed until updated.

High
CloudLinux CloudLinux 7 CloudLinux 9

Affected Versions

7.4 and earlier

Patched Version

7.5

Default Update CMD

yum update -y

Fix Commands

CloudLinux 7

yum clean all
yum update cl-lve

CloudLinux 9

dnf clean metadata
dnf update cl-lve

What this means under a SharedLicense license

Your SharedLicense license itself is not affected — this is a change in CloudLinux 7, CloudLinux 9 software, not in licensing. Update the product through its standard update channel. Licenses keep working through updates; nothing needs re-issuing or re-activating.

A vulnerability in CloudLinux LVE Manager allowed environment variable injection via the $HTTP_HOST header, potentially leading to unauthorized access to protected resources.

References

Security Advisories

Related Advisories

cPanel CVE-2026-87899: Privilege Escalation

2026-09-23 00:00:00

WP Toolkit for cPanel CVE-2026-87900: Argument Injection

2026-09-23 00:00:00

Plesk CVE-2026-68492: Untrusted Search Path

2026-09-23 00:00:00

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System