* SECURITY UPDATE: expat billion-laughs / entity-expansion amplification DoS - debian/patches/CVE-2013-0340.patch: backport libexpat's billion-laughs attack protection (libexpat PR #466 / 2.4.0) into the bundled expat 2.2.8 tree (Modules/expat/xmlparse.c, expat.h, internal.h). Adds the accounting machinery, XML_ERROR_AMPLIFICATION_LIMIT_BREACH and the XML_SetBillionLaughsAttackProtection{MaximumAmplification, ActivationThreshold} setters (default 100x after 8 MiB). The fix is applied to the bundled copy (not system expat) so it coexists with the CloudLinux XML_SetHashSalt16Bytes extension; new public symbols are namespaced in pyexpatns.h. - CVE-2013-0340 * SECURITY UPDATE: control characters accepted in wsgiref response headers - debian/patches/CVE-2026-0865.patch: backport of cpython gh-143916 (GH-143917) and the HTAB follow-up (GH-144762). wsgiref.headers.Headers (Lib/wsgiref/headers.py) now rejects C0/DEL control characters in header names and values; HTAB remains legal in values, not names. Adapted to 2.7 (positional _convert_string_type flag, no keyword-only argument). - CVE-2026-0865 * SECURITY UPDATE: CR/LF injection in HTTP CONNECT tunnel headers - debian/patches/CVE-2026-1502.patch: backport of cpython gh-146211 (GH-146212). HTTPConnection._tunnel() (Lib/httplib.py) validates the tunnel host and each tunnel request header with the existing _contains_disallowed_url_pchar_re / _is_legal_header_name / _is_illegal_header_value helpers, rejecting control characters. - CVE-2026-1502 * SECURITY UPDATE: template injection via cookie values in js_output() - debian/patches/CVE-2026-6019.patch: backport of cpython gh-90309 (GH-148889), on top of CVE-2026-3644. Cookie.Morsel.js_output() (Lib/Cookie.py) base64-encodes the cookie value and emits it via atob() so it cannot break out of the JS string literal. - CVE-2026-6019 * SECURITY UPDATE: bz2 decompressor reuse-after-error stack overflow - debian/patches/CVE-2026-9669.patch: port of cpython gh-150599 (GH-150600) to the 2.7 bz2 wrapper (Modules/bz2module.c). After libbz2 reports a decompression error the stream is inconsistent and reusing it can write past the output buffer; the decompressor now records the error and raises ValueError on any further decompress() call. - CVE-2026-9669