rubygem-cgi -- cookie prefix spoofing in CGI::Cookie.parse

ooooooo_q reports:

    The old versions of CGI::Cookie.parse applied
    URL decoding to cookie names. An attacker could exploit
    this vulnerability to spoof security prefixes in cookie
    names, which may be able to trick a vulnerable
    application.
  

    By this fix, CGI::Cookie.parse no longer
    decodes cookie names. Note that this is an incompatibility
    if cookie names that you are using include
    non-alphanumeric characters that are URL-encoded.