CVE catalog

CVE-2026-39324

Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when configured with secrets:. If cookie decryp

[CVE catalog]

Severity
Critical · CVSS 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.27% · Oct 25, 2026

A flaw was found in Rack::Session. When configured with secrets, the Rack::Session::Cookie component incorrectly handles decryption failures. This allows an unauthenticated attacker to provide a specially crafted session cookie that is accepted as valid, even without knowledge of the configured secret. As a result, an attacker can manipulate session data, potentially leading to unauthorized access to a user's session. github.com/rack/rack-session: Rack::Session: Unauthorized access via crafted session cookies The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Cperack-sessionNot reported2.1.2fixed
Debianruby-rack-session132.1.1-0.1vulnerable
Debianruby-rack-session132.1.1-0.1+deb13u1fixed
Debianruby-rack-session142.1.1-0.1vulnerable
Debianruby-rack-session142.1.1-0.2fixed
Ubunturuby-rack-session25.102.1.1-0.1vulnerable
Ubunturuby-rack-session25.102.1.1-0.1ubuntu0.1fixed
Ubunturuby-rack-session26.042.1.1-0.1vulnerable
Ubunturuby-rack-session26.042.1.1-0.1build1vulnerable
Ubunturuby-rack-session26.042.1.1-0.1ubuntu0.26.04.1fixed
Ubunturuby-rack-session25.102.1.1-0.1vulnerable
Ubunturuby-rack-session25.102.1.1-0.1ubuntu0.1fixed
Opensuserubygem-rack-sessiontumbleweed2.1.2-1.1fixed
Cperack-sessionNot reported2.1.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Cperack-sessioncpeNot reported2.1.2Not reportedNot reportedNot reported
Debianruby-rack-sessiondeb132.1.1-0.1+deb13u1Not reportedDEBIAN-CVE-2026-39324Not reported
Debianruby-rack-sessiondeb142.1.1-0.2Not reportedDEBIAN-CVE-2026-39324Not reported
Ubunturuby-rack-sessiondeb25.102.1.1-0.1ubuntu0.1Not reportedUBUNTU-CVE-2026-39324Not reported
Ubunturuby-rack-sessiondeb26.042.1.1-0.1ubuntu0.26.04.1Not reportedUBUNTU-CVE-2026-39324Not reported
Ubunturuby-rack-sessiondeb25.102.1.1-0.1ubuntu0.1Not reportedUSN-8190-1Not reported
Opensuserubygem-rack-sessionrpmtumbleweed2.1.2-1.1Not reportedOPENSUSE-SU-2026:10604-1Not reported
Cperack-sessioncpeNot reported2.1.2Not reportedNVD-CVE-2026-39324Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [ruby-rack-session]Affected
    Details (3)

    • 2.1.1-0.1 · all · trixie

      Affected · Fixed: 2.1.1-0.1+deb13u1

      nvd · ruby-rack-session · debian · 13

    • 2.1.1-0.1 · all · trixie

      Affected · Fixed: 2.1.1-0.1+deb13u1

      nvd · ruby-rack-session · debian · 13

    • 2.1.1-0.1+deb13u1 · all · trixie-security

      Fixed · Fixed: 2.1.1-0.1+deb13u1

      nvd · ruby-rack-session · debian · 13

[openSUSE Tumbleweed]

Observed:

References

[FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]