* SECURITY UPDATE: cgi DoS via super-linear CGI::Cookie.parse - debian/patches/CVE-2025-27219.patch: in CGI::Cookie.parse (lib/cgi/cookie.rb), merge repeated cookie-name values in place with Array#concat instead of rebuilding the array with Array#+ on every repeat, which was O(N^2) for N repetitions of a name. Backport of upstream ruby/cgi 9907b76. - CVE-2025-27219 * SECURITY UPDATE: cgi ReDoS in CGI::Util#escapeElement - debian/patches/CVE-2025-27220.patch: replace the catastrophically backtracking "(?:.|\n)*?>" patterns in escapeElement and unescapeElement (lib/cgi/util.rb) with linear-time possessive/atomic patterns that also escape unclosed tags. Backport of upstream ruby/cgi cd1eb08. - CVE-2025-27220 * SECURITY UPDATE: uri credential leak combining URIs (CVE-2025-27221 bypass) - debian/patches/CVE-2025-61594.patch: in lib/uri/generic.rb, set_userinfo always assigns @password (so it can be cleared), set_user no longer re-attaches the old password, host=/port= clear the userinfo, initialize sets userinfo after host/port, and merge()/+ replace the authority wholesale through the new set_authority/authority accessors so the base URI's password is no longer leaked, e.g. (URI("http://user:pass@h") + "//new@h2/p") no longer keeps ":pass". Backport of upstream ruby/uri 2789182, 5cec76b and 6c6449e. - CVE-2025-61594 * SECURITY UPDATE: cgi HTTP response splitting via unvalidated header/cookie values - debian/patches/CVE-2021-33621.patch: add _no_crlf_check in lib/cgi/core.rb so every emitted status/header value (including Set-Cookie) is rejected if it contains CR or LF, and add TOKEN_RE/PATH_VALUE_RE/DOMAIN_VALUE_RE validation with validating name=/path=/domain= setters in lib/cgi/cookie.rb. Backport of upstream ruby/cgi 64c5045, 30107a4 and b46d41c, adapted to the pre-gemified 2.6.10 cgi layout. - CVE-2021-33621