- CVE-2013-0340: backport libexpat's billion-laughs / internal-entity-expansion amplification protection into the bundled expat 2.2.8 tree (Modules/expat/). xmlparse.c/expat.h/internal.h gain the libexpat 2.4.0 accounting machinery (XML_SetBillionLaughsAttackProtectionMaximumAmplification / ...ActivationThreshold, default 100x after 8 MiB) and a new XML_ERROR_AMPLIFICATION_LIMIT_BREACH; entity expansion that exceeds the amplification limit is now rejected instead of expanding unbounded. Adapted to coexist with the CloudLinux XML_SetHashSalt16Bytes extension; the system expat is NOT used. New public symbols are namespaced in pyexpatns.h. - CVE-2026-0865: reject C0/DEL control characters in wsgiref.headers.Headers (Lib/wsgiref/headers.py); HTAB stays legal in values but not names. Backport of gh-143916 (GH-143917) plus the HTAB follow-up (GH-144762). - CVE-2026-1502: reject CR/LF and other illegal characters in HTTP CONNECT tunnel host and request headers in HTTPConnection._tunnel() (Lib/httplib.py), using the existing _contains_disallowed_url_pchar_re / _is_legal_header_name / _is_illegal_header_value helpers. Backport of gh-146211 (GH-146212). - CVE-2026-6019: base64-encode the cookie value embedded in Cookie.Morsel.js_output() and emit it via atob() to prevent template injection (Lib/Cookie.py). Backport of gh-90309 (GH-148889), on top of CVE-2026-3644. - CVE-2026-9669: prevent bz2.BZ2Decompressor reuse after a decompression error (Modules/bz2module.c). After libbz2 reports an error the stream is inconsistent and re-entering it can overflow the output buffer; the decompressor now records the error and raises ValueError on any further decompress() call. Port of gh-150599 (GH-150600) to the 2.7 bz2 wrapper.