This is security patch.
Because Merb is using this in line
270 Hash.from_xml(raw_post) of request.rb file to parse request it is unsafe.