Fix intermittent 502 errors on cPanel webmail service subdomains

Service subdomains (webmail., cpanel., whm., and webdisk.) are Apache virtual hosts that reverse-proxy to cpsrvd on the local machine. When Apache reuses a pooled backend connection that cpsrvd has already closed, or refuses to reuse across users, the request fails and the customer sees a 502 Bad Gateway. It is intermittent: a refresh usually works, which is why it reaches you as "webmail is flaky" rather than "webmail is down".

This guide covers the version history, how to confirm you have this specific bug, and the workaround cPanel support applies. It is for WHM admins on cPanel & WHM 136 or 138, particularly servers running mod_ruid2 or ea-nginx.

Which versions are affected

cPanel fixed a service proxy subdomain bug on mod_ruid2 systems as CPANEL-54005, shipped in 136.0.24 and 138.0.0. The symptom has since come back: we reproduced intermittent 502s on webmail. subdomains on 11.138.0.15 at the end of October 2026, and cPanel support confirmed it as a regression of CPANEL-54005, now tracked internally as CPANEL-58186. There is no fixed build at the time of writing, so watch the cPanel 138 release notes and the official change log for that case number.

cPanel also publishes a separate support article for the same 502 on service subdomains when ea-nginx runs as a reverse proxy in front of Apache. The cause and the workaround are the same.

Confirm it is this bug

Check the version and the modules involved:

/usr/local/cpanel/cpanel -V
rpm -q ea-apache24-mod_ruid2 ea-nginx
grep jailapache /var/cpanel/cpanel.config

Then reproduce. Hit the subdomain 50 times and count status codes:

for i in $(seq 1 50); do curl -s -o /dev/null -w '%{http_code}\n' https://webmail.example.com/; done | sort | uniq -c

A mix of 200 and a handful of 502 is this bug. All 502 means cpsrvd is down or blocked, not a pooling problem. Restart it with /scripts/restartsrv_cpsrvd and check the firewall before going further.

Finally, look at the Apache error log around the timestamp of a failed request:

grep -E 'proxy|AH01102' /usr/local/apache/logs/error_log | tail -n 20

Proxy errors naming the local backend (127.0.0.1), such as "error reading status line from remote server", confirm Apache dropped the request between itself and cpsrvd.

Turn off the experimental jail setting

If jailapache=1 came back from the check above, start here. WHM » Server Configuration » Tweak Settings » System has an option called EXPERIMENTAL: Jail Apache Virtual Hosts using mod_ruid2 and cPanel® jailshell. cPanel support treats it as unsupported and has linked it to service subdomain 502s before. Set it to Off, save, and run the reproduction loop again.

If you rely on it for tenant isolation, move to CloudLinux CageFS instead. It solves the same problem and is supported. Our Tweak Settings guide covers what else on that screen is safe to change.

Apply the Apache include workaround

If the 502s persist, stop Apache from pooling connections to the service subdomain backends. Go to WHM » Service Configuration » Apache Configuration » Include Editor, open Pre VirtualHost Include, choose All Versions, and add:

SetEnvIf Host "^(webmail|cpanel|whm|webdisk)\." proxy-nokeepalive=1
SetEnvIf Host "^(webmail|cpanel|whm|webdisk)\." proxy-initial-not-pooled=1

This writes to /etc/apache2/conf.d/includes/pre_virtualhost_global.conf, which survives EasyApache rebuilds and cPanel updates. Then rebuild and hard-restart Apache:

/scripts/rebuildhttpdconf
/scripts/restartsrv_httpd --hard

proxy-nokeepalive makes Apache close the backend connection after every request. proxy-initial-not-pooled stops it from reusing a pooled connection for the first request on a new client connection, which is the race that produces "error reading status line". Both are standard mod_proxy variables. The cost is a fresh TCP connection to cpsrvd for each request, which is negligible for webmail traffic. The Host match keeps customer sites untouched.

Run the curl loop again. You should see 50 200 responses. Remove the include once a build that fixes CPANEL-58186 is installed, so you don't carry workarounds you no longer need. If you keep production servers on the RELEASE tier, our update tiers guide explains how to pick up the fix without jumping to EDGE.

When the workaround doesn't help

• Customers reach webmail on the bare domain. That route is example.com:2096 direct to cpsrvd, not a service subdomain. A 502 there is a different problem.
• Updates are half-applied. A failed upcp can leave cpsrvd and the Apache templates out of step. Fix that first with our guide to cPanel update failures.
• Cloudflare or a load balancer sits in front. Check that the 502 really comes from your Apache. If nothing appears in the error log, it is upstream of the server.

Next steps

• cPanel 138 release notes — what changed in the 138 branch and what to test after upgrading.
• Enable nginx caching with ea-nginx — how ea-nginx sits in front of Apache and where proxy problems show up.
• Licensing a new cPanel server or moving tiers? See the cPanel license page or compare tiers.