PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-21863 cPanel CVE debrief

cPanel’s EasyApache 4 25.49 release updates ea-valkey72 from Valkey 7.2.11 to 7.2.12 to address CVE-2026-21863, described by the vendor as a remote denial-of-service condition triggered by a malformed Valkey Cluster bus message. For environments that rely on the packaged Valkey component, this is primarily an availability fix and should be applied promptly.

Vendor
cPanel
Product
cPanel/WHM
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-23
Original CVE updated
2026-02-25
Advisory published
Unknown
Advisory updated
Unknown

Who should care

cPanel/WHM administrators and infrastructure teams running EasyApache 4 with ea-valkey72 installed, especially environments that rely on Valkey availability or use Cluster features.

Technical summary

The vendor advisory states that ea-valkey72 was updated from Valkey 7.2.11 to 7.2.12 in EasyApache 4 25.49 to fix CVE-2026-21863. The issue is described only as a remote DoS caused by a malformed Valkey Cluster bus message. The supplied source corpus does not provide additional details about attack preconditions, authentication, or exploitation mechanics beyond the service-disruption impact.

Defensive priority

High for systems running ea-valkey72; prioritize patching to Valkey 7.2.12 at the next maintenance window, or sooner if the service is externally reachable or mission-critical.

Recommended defensive actions

  • Upgrade EasyApache 4 to 25.49 or later so ea-valkey72 is updated to Valkey 7.2.12.
  • Verify deployed systems are no longer running ea-valkey72 version 7.2.11.
  • If you use Valkey Cluster, review network exposure and restrict cluster traffic to trusted hosts and networks.
  • Monitor Valkey service stability and logs after patching to confirm normal operation.

Evidence notes

The only substantive evidence in the supplied corpus is the official cPanel release note for EasyApache 4 25.49, which explicitly names CVE-2026-21863, describes it as a remote DoS via a malformed Valkey Cluster bus message, and states that ea-valkey72 was updated from 7.2.11 to 7.2.12. No CVSS score, severity value, publication date, or modification date was provided in the supplied CVE fields or timeline fields.

Official resources

Vendor official release note only. The supplied corpus does not include CVE publication or modification timestamps, so no date-based issue timeline is available here.