EasyApache 4 25.69: cPanel patches six Tomcat CVEs in ea-tomcat101

cPanel shipped EasyApache 4 version 25.69 on 2 July 2026 as a security release for the ea-tomcat101 package, bumping bundled Apache Tomcat from the 10.1.x line to 10.1.56. It closes six CVEs disclosed against Tomcat's 8.5/9.0/10.1 branches in late June 2026, the most serious of which is an access-control bypass on the default servlet. If you provision Tomcat through EasyApache 4 for Java apps alongside your PHP sites, this is worth running today rather than waiting for the next scheduled upcp.

What's fixed

cPanel's release notes list a top severity of "Moderate" across the batch, but the upstream Tomcat advisories rate the worst of the six higher. Each CVE affects the 8.5.x and 9.0.x branches directly, with equivalent fixes carried into the 10.1.x branch that ea-tomcat101 tracks:

CVE	Issue	Upstream severity
CVE-2026-55956	Default servlet ignores HTTP-method-specific security constraints	Moderate–High
CVE-2026-55955	`EncryptInterceptor` cluster traffic has no replay protection	Low
CVE-2026-55276	Effective `web.xml` logging omits security role/constraint data, misleading audits	Low
CVE-2026-53434	FFM/OpenSSL connector silently accepts certs from an unparseable CRL	Low
CVE-2026-53404	`RewriteValve` OR-chained conditions skip subsequent non-OR rules	Low
CVE-2026-50229	XSS in the bundled examples webapp via wildcard property mapping	Low

CVE-2026-55956 is the one to actually worry about. If you protect specific paths behind the default servlet with a method-scoped <security-constraint> — say, allowing GET but blocking PUT/DELETE on a static resource directory — Tomcat wasn't enforcing that method restriction at all. Anyone could hit the blocked methods regardless of the constraint. The other five are defence-in-depth or logging-accuracy fixes; useful to have, but none of them are remotely exploitable access-control failures on their own.

None of these six overlap with [CVE-2026-41940](/kb/cpanel-whm-cve-2026-41940-auth-bypass), the cpsrvd session-handling bypass patched in April — that one lived in cPanel's own auth code, this batch lives entirely in the Tomcat package EasyApache compiles.

Check your version

/usr/local/cpanel/bin/easyapache4 --list=installed | grep tomcat

Or check the running Tomcat version directly per provisioned instance:

find /home/*/ea-podman.d/ea-tomcat101.* -maxdepth 1 -name 'RELEASE-NOTES*' 2>/dev/null

If your ea-tomcat101 package predates 25.69, or the reported Tomcat version is below 10.1.56, you're on the vulnerable build.

Update

/scripts/easyapache4 --upgrade-check
yum update ea-tomcat101

Or through WHM: Software → EasyApache 4 → Currently Installed Packages, then Update Server. The update rebuilds the ea-tomcat101 container image; existing WAR deployments and conf/server.xml customisations under /home/<user>/ea-podman.d/ea-tomcat101.<user>.<n>/ survive the upgrade since they live outside the package's own files.

Restart provisioned instances after updating

Updating the ea-tomcat101 RPM doesn't restart containers that are already running against the old image. After the package update, cycle each account's instance:

/scripts/ea-podman restart ea-tomcat101.<cpanelusername>.<n>

Skipping this leaves the vulnerable Tomcat binary live in memory even though the on-disk package is current.

Why this matters even at "Moderate"

Tomcat's own security team consistently under-rates access-control bypasses relative to how they get used in practice — a method-restriction bypass on the default servlet is exactly the kind of bug that turns "we only allow GET on this endpoint" into an assumption an attacker can walk straight through. If you're running multi-tenant Tomcat instances through EasyApache — several customers' WAR deployments on one server, each expecting the platform's constraints to hold — treat this as you would any other cross-account isolation bug and patch on the same timeline you'd use for a cPanel core CVE, not on the next quarterly maintenance window. A current cPanel license is what keeps /scripts/upcp and EasyApache pulling these updates automatically in the first place.

Does EasyApache 4 25.69 affect servers that don't run Tomcat?+

No. The update only touches the ea-tomcat101 package. If you've never provisioned Tomcat through EasyApache 4, there's nothing to patch and no exposure from these six CVEs.

What Tomcat version fixes these CVEs?+

EasyApache 4 25.69 bundles Apache Tomcat 10.1.56 in ea-tomcat101. Confirm your installed package version is 25.69 or later, or check the running Tomcat version directly against 10.1.56.

Is CVE-2026-55956 remotely exploitable without authentication?+

It's an access-control bypass, not a remote-code-execution bug — it lets requests through that a method-scoped security constraint should have blocked, without needing valid credentials. Whether that's dangerous depends entirely on what you were relying on the constraint to protect.

Do I need to redeploy my WAR files after updating?+

No. The package update rebuilds the Tomcat runtime image; your webapps directory and server.xml customisations under each account's ea-podman.d path are untouched. You do need to restart each provisioned instance for the new binary to take effect.

Does this affect ea-tomcat85 as well as ea-tomcat101?+

This specific EasyApache 4 25.69 release only updates ea-tomcat101. If you're still running the older ea-tomcat85 package, check cPanel's changelog separately — legacy Tomcat 8.5 branches are increasingly likely to be deprecated rather than patched.

Next steps

EasyApache 4 MPM selection guide — background on how EasyApache packages fit together if you're new to provisioning Tomcat this way.
CVE-2026-41940: the cPanel & WHM auth bypass — the unrelated April 2026 cPanel core vulnerability, if you're auditing both in one pass.
cPanel & WHM version 136 release notes — the platform release this EasyApache update ships alongside.