alt-ruby26 (2.6.10-19) stable; urgency=medium

  * SECURITY UPDATE: cgi DoS via super-linear CGI::Cookie.parse
    - debian/patches/CVE-2025-27219.patch: in CGI::Cookie.parse
      (lib/cgi/cookie.rb), merge repeated cookie-name values in place with
      Array#concat instead of rebuilding the array with Array#+ on every
      repeat, which was O(N^2) for N repetitions of a name. Backport of
      upstream ruby/cgi 9907b76.
    - CVE-2025-27219
  * SECURITY UPDATE: cgi ReDoS in CGI::Util#escapeElement
    - debian/patches/CVE-2025-27220.patch: replace the catastrophically
      backtracking "(?:.|\n)*?>" patterns in escapeElement and
      unescapeElement (lib/cgi/util.rb) with linear-time
      possessive/atomic patterns that also escape unclosed tags. Backport
      of upstream ruby/cgi cd1eb08.
    - CVE-2025-27220
  * SECURITY UPDATE: uri credential leak combining URIs (CVE-2025-27221 bypass)
    - debian/patches/CVE-2025-61594.patch: in lib/uri/generic.rb,
      set_userinfo always assigns @password (so it can be cleared),
      set_user no longer re-attaches the old password, host=/port= clear
      the userinfo, initialize sets userinfo after host/port, and
      merge()/+ replace the authority wholesale through the new
      set_authority/authority accessors so the base URI's password is no
      longer leaked, e.g.
      (URI("http://user:pass@h") + "//new@h2/p") no longer keeps ":pass".
      Backport of upstream ruby/uri 2789182, 5cec76b and 6c6449e.
    - CVE-2025-61594
  * SECURITY UPDATE: cgi HTTP response splitting via unvalidated header/cookie values
    - debian/patches/CVE-2021-33621.patch: add _no_crlf_check in
      lib/cgi/core.rb so every emitted status/header value (including
      Set-Cookie) is rejected if it contains CR or LF, and add
      TOKEN_RE/PATH_VALUE_RE/DOMAIN_VALUE_RE validation with validating
      name=/path=/domain= setters in lib/cgi/cookie.rb. Backport of
      upstream ruby/cgi 64c5045, 30107a4 and b46d41c, adapted to the
      pre-gemified 2.6.10 cgi layout.
    - CVE-2021-33621

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 10 Jun 2026 00:00:00 +0000

alt-ruby26 (2.6.10-18) stable; urgency=medium

  * SECURITY UPDATE: REXML DoS via an attribute value containing many '>'
    - debian/patches/CVE-2024-35176.patch: in parse_attributes
      (lib/rexml/parsers/baseparser.rb), resolve the missing-closing-quote
      case in a single pass -- read the value rest up to the closing quote
      and then up to the tag end with two source.match calls -- instead of
      consuming one '>'-chunk per iteration, which reset the scanner and
      re-ran ATTRIBUTE_PATTERN over the accumulating buffer, giving O(N^2)
      behaviour. Also make IOSource#match (lib/rexml/source.rb) retry the
      pattern after every read attempt so the partial buffer is matched once
      more before the source is declared exhausted, as required by the new
      value-rest read. Adapted from upstream ruby/rexml ba70cfef ("Read
      quoted attributes in chunks"); the read_until API added upstream has
      no callers here once parse_attributes is fixed in place. Adds a
      Timeout-based regression test
      (test/rexml/parse/test_attribute_gt_redos.rb) adapted from upstream.
    - CVE-2024-35176
  * SECURITY UPDATE: REXML ReDoS via repeated spaces inside <!ATTLIST
    - debian/patches/CVE-2024-39908.patch: in the ATTLIST branch
      (lib/rexml/parsers/baseparser.rb) drop the leading "<!ATTLIST" literal
      and strip the result before scanning with ATTDEF_RE, so a long run of
      spaces between "<!ATTLIST" and the element name is no longer re-walked
      by the backtracking per-attdef scan (O(N^2) -> linear). Adapted from
      upstream ruby/rexml 1f1e6e9; a byte-identical md[0].strip is a no-op on
      3.1.9.1 because here md[0] starts with the "<!ATTLIST" literal, so the
      space run is interior rather than leading. Adds a Timeout-based
      regression test (test/rexml/parse/test_attlist.rb) adapted from
      upstream.
    - CVE-2024-39908
  * SECURITY UPDATE: Heap buffer overflow in bundled zlib gem via
    Zlib::GzipReader#ungetc
    - debian/patches/CVE-2026-27820.patch: make the output-buffer expansion
      in zstream_buffer_ungets() unconditional in ext/zlib/zlib.c, so a large
      ungetc payload can no longer be memmove'd/written past the allocation.
      Backport of ruby/zlib commit 608d2be6. Adds the upstream regression
      test test_ungetc_buffer_underflow to test/zlib/test_zlib.rb.
    - CVE-2026-27820
  * Stabilise the in-build test suite on busy build nodes (no shipped-content
    change):
    - debian/rules: on debian>=12 also skip the net/http and net/smtp tests,
      which spawn TCP servers via tcp_server_sockets_port0 and flake with
      Errno::EADDRINUSE under concurrent builds (mirrors alt-ruby31).
    - debian/patches/fix-tests-mjit-fork.patch: backport upstream 7a859b6a
      (Ruby 2.7.0+) to fix the flaky TestJIT#test_fork_with_mjit_worker_thread
      stderr output race; never backported to the 2.6 series.

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 03 Jun 2026 00:00:00 +0000

alt-ruby26 (2.6.10-17) stable; urgency=medium

  * SECURITY UPDATE: Bundler argument injection via leading-dash Gemfile git URL
    - debian/patches/CVE-2021-43809.patch: insert "--" end-of-options
      separator before the URI in the clone and fetch commands built by
      lib/bundler/source/git/git_proxy.rb.
    - CVE-2021-43809

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 06 May 2026 09:55:00 +0000

alt-ruby26 (2.6.10-16) stable; urgency=medium

  * SECURITY UPDATE: REXML ReDoS via leading-zero hex character reference
    - debian/patches/CVE-2024-49761.patch: replace the
      /&#0*((?:\d+)|(?:x[a-fA-F0-9]+));/ regex in unnormalize() with
      /&#((?:\d+)|(?:x[a-fA-F0-9]+));/ so that &#0x...; is no longer
      accepted as a hex character reference, eliminating the
      catastrophic-backtracking ReDoS on inputs with many leading
      zeros.
    - CVE-2024-49761
  * SECURITY UPDATE: REXML DoS via deep same-local-name attributes
    - debian/patches/CVE-2024-43398.patch: replace the per-attribute
      tree-walk in Element#[]= with an O(1) parse-time conflict check
      using a parser-level @namespaces hash and an expanded_names
      hash keyed on [uri, local_part]; seed @namespaces with the
      implicitly-bound xml prefix per upstream 78f8712 to avoid
      breaking XHTML documents that use both xml:lang and lang.
    - CVE-2024-43398
  * SECURITY UPDATE: REXML DoS via entity expansion in SAX/pull parsers
    - debian/patches/CVE-2024-41946.patch: route the SAX2Parser :text
      handler through @parser.unnormalize (upstream prerequisite
      4ebf21f), and add @entity_expansion_count + per-call
      sum/Security.entity_expansion_text_limit accounting in
      BaseParser so that billion-laughs-style XML triggers
      "entity expansion has grown too large" / "number of entity
      expansions exceeded" in SAX and pull mode, matching the
      existing DOM behaviour.
    - CVE-2024-41946
  * SECURITY UPDATE: REXML DoS via slow processing-instruction parsing
    - debian/patches/CVE-2024-41123.patch: rewrite process_instruction
      to call parse_name and then match the content separately,
      avoiding the catastrophic-backtracking INSTRUCTION_PATTERN
      regex; grow the IOSource read buffer exponentially via
      min_bytes so that source.match() is O(log n) attempts rather
      than O(n) on inputs that never match the regex.
    - CVE-2024-41123
  * Add debian/patches/rexml-cve-tests.patch with regression tests
    adapted from upstream for the four CVEs above; replaces
    assert_linear_performance (not available on 2.6) with
    Timeout-based guards and uses class+message form of assert_raise
    so the tests work under the bundled minitest-style Test::Unit.

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 30 Apr 2026 12:00:00 +0200

alt-ruby26 (2.6.10-15) stable; urgency=medium

  * ALR-235: Build for Debian 12 and 13 ARM platforms.

 -- Razmik Manvelyan <rmanvelyan@cloudlinux.com>  Tue, 24 Mar 2026 14:00:00 +0400

alt-ruby26 (2.6.10-14) stable; urgency=medium

  * Security fixes
    - CVE-2023-28756: Fix ReDoS vulnerability in Time.rfc2822 parsing.

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 09 Feb 2026 13:20:00 +0100

alt-ruby26 (2.6.10-13) stable; urgency=medium

  * ALR-220: Build for Debian 12 and 13.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Wed, 19 Nov 2025 14:20:00 +0200

alt-ruby26 (2.6.10-1) stable; urgency=medium

  * ALR-175: initial build

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Mon, 31 Jul 2023 15:00:00 +0200
