alt-ruby26 (2.6.10-20) stable; urgency=medium

  * SECURITY UPDATE: uri ReDoS in the RFC3986 and RFC2396 parsers
    - debian/patches/CVE-2023-28755.patch: clamp the greedy quantifiers of
      RFC3986_URI and RFC3986_relative_ref in lib/uri/rfc3986_parser.rb to
      possessive ones (17 * -> *+, 9 + -> ++), so a crafted URI such as
      URI.parse('https://example.com/dir/' + 'a' * 80000 + '/##.jpg') no
      longer backtracks quadratically, and add the (?: ) group around
      IPv6address/IPvFuture that RFC3986_relative_ref was missing. Backport
      of upstream ruby/uri 37770c2 and 17861a5 (uri 0.10.0.1). The same patch
      also carries the CVE-2023-36617 follow-up, which upstream describes as
      existing "because of an incomplete fix for CVE-2023-28755": the two
      leading quantifiers the original fix left greedy, one in each parser.
      In lib/uri/rfc3986_parser.rb the whitespace run of the PORT component
      regexp of RFC3986_Parser#default_regexp is clamped to a possessive
      quantifier, and in lib/uri/rfc2396_parser.rb the leading '\A\s*' of the
      ABS_URI and REL_URI patterns built by RFC2396_Parser#initialize_regexp
      becomes '\A\s*+', so
      URI.parse('http://my.example.com').port = "\t" * 8000 + 'a' and
      URI::RFC2396_Parser.new.split(' ' * 8000 + "\0") no longer backtrack
      quadratically either. Backport of upstream ruby/uri 9010ee2 and
      9d7bcef, folded into the same patch since upstream never ships one
      parser's fix without the other's and both are the same defect class;
      the patch header records the full provenance. This tree has a single
      uri copy (pre-gemified, no bundler-vendored copy) and it is now
      hardened in both parsers; no vendored version string is touched.
    - CVE-2023-28755
    - CVE-2023-36617
  * SECURITY UPDATE: stringio buffer overread in ungetc/ungetbyte
    - debian/patches/CVE-2024-27280.patch: in ext/stringio/stringio.c,
      strio_unget_bytes() computed the string growth as cl+rest when the
      position is at or past the end, so rb_str_set_len() declared cl+pos
      valid bytes while only cl were written and the tail of the returned
      String exposed stale heap contents. Grow by cl - (rest < 0 ? pos :
      len) instead. Backport of upstream ruby/stringio a35268a
      (stringio 3.0.1.1).
    - CVE-2024-27280
  * SECURITY UPDATE: rdoc code execution via .rdoc_options and ri cache
    - debian/patches/CVE-2024-27281.patch: RDoc::RDoc#load_options read
      ./.rdoc_options with YAML.load_file and RDoc::Store loaded the ri
      cache with a bare Marshal.load, so a crafted project directory or ri
      cache instantiated arbitrary objects. Load the options file with
      YAML.safe_load(permitted_classes: [RDoc::Options, Symbol]) and pass a
      MarshalFilter proc to Marshal.load that only admits plain data types
      and RDoc's own classes. Backport of upstream ruby/rdoc 32ff6ba0,
      60a6d74e and a5de13bf (rdoc 6.3.4 + 6.3.4.1), with safe_load_file
      expressed as safe_load(File.read(...)) because psych 3.1.0 has no
      safe_load_file.
    - CVE-2024-27281
  * SECURITY UPDATE: regexp arbitrary heap read in Onigmo search
    - debian/patches/CVE-2024-27282.patch: onig_search() clamps reg->dmax
      to the end of the subject but not reg->dmin, so forward_search_range()
      (p += reg->dmin) and backward_search_range() (range += reg->dmin)
      could scan for the exact/map target past the end of the subject
      buffer. Reject the search when reg->dmin exceeds the subject length.
      Backport of upstream ruby/ruby 33e5b47c (Ruby 3.0.7).
    - CVE-2024-27282

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Fri, 31 Jul 2026 00:00:00 +0000

alt-ruby26 (2.6.10-19) stable; urgency=medium

  * SECURITY UPDATE: cgi DoS via super-linear CGI::Cookie.parse
    - debian/patches/CVE-2025-27219.patch: in CGI::Cookie.parse
      (lib/cgi/cookie.rb), merge repeated cookie-name values in place with
      Array#concat instead of rebuilding the array with Array#+ on every
      repeat, which was O(N^2) for N repetitions of a name. Backport of
      upstream ruby/cgi 9907b76.
    - CVE-2025-27219
  * SECURITY UPDATE: cgi ReDoS in CGI::Util#escapeElement
    - debian/patches/CVE-2025-27220.patch: replace the catastrophically
      backtracking "(?:.|\n)*?>" patterns in escapeElement and
      unescapeElement (lib/cgi/util.rb) with linear-time
      possessive/atomic patterns that also escape unclosed tags. Backport
      of upstream ruby/cgi cd1eb08.
    - CVE-2025-27220
  * SECURITY UPDATE: uri credential leak combining URIs (CVE-2025-27221 bypass)
    - debian/patches/CVE-2025-61594.patch: in lib/uri/generic.rb,
      set_userinfo always assigns @password (so it can be cleared),
      set_user no longer re-attaches the old password, host=/port= clear
      the userinfo, initialize sets userinfo after host/port, and
      merge()/+ replace the authority wholesale through the new
      set_authority/authority accessors so the base URI's password is no
      longer leaked, e.g.
      (URI("http://user:pass@h") + "//new@h2/p") no longer keeps ":pass".
      Backport of upstream ruby/uri 2789182, 5cec76b and 6c6449e.
    - CVE-2025-61594
  * SECURITY UPDATE: cgi HTTP response splitting via unvalidated header/cookie values
    - debian/patches/CVE-2021-33621.patch: add _no_crlf_check in
      lib/cgi/core.rb so every emitted status/header value (including
      Set-Cookie) is rejected if it contains CR or LF, and add
      TOKEN_RE/PATH_VALUE_RE/DOMAIN_VALUE_RE validation with validating
      name=/path=/domain= setters in lib/cgi/cookie.rb. Backport of
      upstream ruby/cgi 64c5045, 30107a4 and b46d41c, adapted to the
      pre-gemified 2.6.10 cgi layout.
    - CVE-2021-33621

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 10 Jun 2026 00:00:00 +0000

alt-ruby26 (2.6.10-18) stable; urgency=medium

  * SECURITY UPDATE: REXML DoS via an attribute value containing many '>'
    - debian/patches/CVE-2024-35176.patch: in parse_attributes
      (lib/rexml/parsers/baseparser.rb), resolve the missing-closing-quote
      case in a single pass -- read the value rest up to the closing quote
      and then up to the tag end with two source.match calls -- instead of
      consuming one '>'-chunk per iteration, which reset the scanner and
      re-ran ATTRIBUTE_PATTERN over the accumulating buffer, giving O(N^2)
      behaviour. Also make IOSource#match (lib/rexml/source.rb) retry the
      pattern after every read attempt so the partial buffer is matched once
      more before the source is declared exhausted, as required by the new
      value-rest read. Adapted from upstream ruby/rexml ba70cfef ("Read
      quoted attributes in chunks"); the read_until API added upstream has
      no callers here once parse_attributes is fixed in place. Adds a
      Timeout-based regression test
      (test/rexml/parse/test_attribute_gt_redos.rb) adapted from upstream.
    - CVE-2024-35176
  * SECURITY UPDATE: REXML ReDoS via repeated spaces inside <!ATTLIST
    - debian/patches/CVE-2024-39908.patch: in the ATTLIST branch
      (lib/rexml/parsers/baseparser.rb) drop the leading "<!ATTLIST" literal
      and strip the result before scanning with ATTDEF_RE, so a long run of
      spaces between "<!ATTLIST" and the element name is no longer re-walked
      by the backtracking per-attdef scan (O(N^2) -> linear). Adapted from
      upstream ruby/rexml 1f1e6e9; a byte-identical md[0].strip is a no-op on
      3.1.9.1 because here md[0] starts with the "<!ATTLIST" literal, so the
      space run is interior rather than leading. Adds a Timeout-based
      regression test (test/rexml/parse/test_attlist.rb) adapted from
      upstream.
    - CVE-2024-39908
  * SECURITY UPDATE: Heap buffer overflow in bundled zlib gem via
    Zlib::GzipReader#ungetc
    - debian/patches/CVE-2026-27820.patch: make the output-buffer expansion
      in zstream_buffer_ungets() unconditional in ext/zlib/zlib.c, so a large
      ungetc payload can no longer be memmove'd/written past the allocation.
      Backport of ruby/zlib commit 608d2be6. Adds the upstream regression
      test test_ungetc_buffer_underflow to test/zlib/test_zlib.rb.
    - CVE-2026-27820
  * Stabilise the in-build test suite on busy build nodes (no shipped-content
    change):
    - debian/rules: on debian>=12 also skip the net/http and net/smtp tests,
      which spawn TCP servers via tcp_server_sockets_port0 and flake with
      Errno::EADDRINUSE under concurrent builds (mirrors alt-ruby31).
    - debian/patches/fix-tests-mjit-fork.patch: backport upstream 7a859b6a
      (Ruby 2.7.0+) to fix the flaky TestJIT#test_fork_with_mjit_worker_thread
      stderr output race; never backported to the 2.6 series.

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 03 Jun 2026 00:00:00 +0000

alt-ruby26 (2.6.10-17) stable; urgency=medium

  * SECURITY UPDATE: Bundler argument injection via leading-dash Gemfile git URL
    - debian/patches/CVE-2021-43809.patch: insert "--" end-of-options
      separator before the URI in the clone and fetch commands built by
      lib/bundler/source/git/git_proxy.rb.
    - CVE-2021-43809

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 06 May 2026 09:55:00 +0000

alt-ruby26 (2.6.10-16) stable; urgency=medium

  * SECURITY UPDATE: REXML ReDoS via leading-zero hex character reference
    - debian/patches/CVE-2024-49761.patch: replace the
      /&#0*((?:\d+)|(?:x[a-fA-F0-9]+));/ regex in unnormalize() with
      /&#((?:\d+)|(?:x[a-fA-F0-9]+));/ so that &#0x...; is no longer
      accepted as a hex character reference, eliminating the
      catastrophic-backtracking ReDoS on inputs with many leading
      zeros.
    - CVE-2024-49761
  * SECURITY UPDATE: REXML DoS via deep same-local-name attributes
    - debian/patches/CVE-2024-43398.patch: replace the per-attribute
      tree-walk in Element#[]= with an O(1) parse-time conflict check
      using a parser-level @namespaces hash and an expanded_names
      hash keyed on [uri, local_part]; seed @namespaces with the
      implicitly-bound xml prefix per upstream 78f8712 to avoid
      breaking XHTML documents that use both xml:lang and lang.
    - CVE-2024-43398
  * SECURITY UPDATE: REXML DoS via entity expansion in SAX/pull parsers
    - debian/patches/CVE-2024-41946.patch: route the SAX2Parser :text
      handler through @parser.unnormalize (upstream prerequisite
      4ebf21f), and add @entity_expansion_count + per-call
      sum/Security.entity_expansion_text_limit accounting in
      BaseParser so that billion-laughs-style XML triggers
      "entity expansion has grown too large" / "number of entity
      expansions exceeded" in SAX and pull mode, matching the
      existing DOM behaviour.
    - CVE-2024-41946
  * SECURITY UPDATE: REXML DoS via slow processing-instruction parsing
    - debian/patches/CVE-2024-41123.patch: rewrite process_instruction
      to call parse_name and then match the content separately,
      avoiding the catastrophic-backtracking INSTRUCTION_PATTERN
      regex; grow the IOSource read buffer exponentially via
      min_bytes so that source.match() is O(log n) attempts rather
      than O(n) on inputs that never match the regex.
    - CVE-2024-41123
  * Add debian/patches/rexml-cve-tests.patch with regression tests
    adapted from upstream for the four CVEs above; replaces
    assert_linear_performance (not available on 2.6) with
    Timeout-based guards and uses class+message form of assert_raise
    so the tests work under the bundled minitest-style Test::Unit.

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 30 Apr 2026 12:00:00 +0200

alt-ruby26 (2.6.10-15) stable; urgency=medium

  * ALR-235: Build for Debian 12 and 13 ARM platforms.

 -- Razmik Manvelyan <rmanvelyan@cloudlinux.com>  Tue, 24 Mar 2026 14:00:00 +0400

alt-ruby26 (2.6.10-14) stable; urgency=medium

  * Security fixes
    - CVE-2023-28756: Fix ReDoS vulnerability in Time.rfc2822 parsing.

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 09 Feb 2026 13:20:00 +0100

alt-ruby26 (2.6.10-13) stable; urgency=medium

  * ALR-220: Build for Debian 12 and 13.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Wed, 19 Nov 2025 14:20:00 +0200

alt-ruby26 (2.6.10-1) stable; urgency=medium

  * ALR-175: initial build

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Mon, 31 Jul 2023 15:00:00 +0200
