PT-2026-30806 · Unknown · Rack::Session

Sm1Ee · Published 2026-04-07 · Updated 2026-04-28 · CVE-2026-39324

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rack::Session versions 2.0.0 through 2.1.1

Description Rack::Session is a session management implementation for Rack. Versions 2.0.0 through 2.1.1 incorrectly handle decryption failures when configured with secrets. If cookie decryption fails, the implementation falls back to a default decoder instead of rejecting the cookie. This allows an unauthenticated attacker to supply a crafted session cookie that is accepted as valid session data without knowledge of any configured secret. An attacker can manipulate session contents and potentially gain unauthorized access.

Recommendations Update Rack::Session to version 2.1.2 or later.

Exploit

Fix

RCE

Insufficient Verification of Data Authenticity

Improper Authentication

Deserialization of Untrusted Data

Weakness Enumeration

CWE-345

CWE-287

CWE-502

CWE-565

Related Identifiers

CVE-2026-39324

GHSA-33QG-7WPP-89CQ

OPENSUSE-SU-2026:10604-1

USN-8190-1

USN-8190-2

Affected Products

Rack::Session

References · 23

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack-session/CVE-2026-39324.yml · Exploit
• https://github.com/rack/rack-session/security/advisories/GHSA-33qg-7wpp-89cq · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-39324 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-33qg-7wpp-89cq · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-39324 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8190-2 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-39324 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-39324 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-39324 · Security Note
• https://osv.dev/vulnerability/USN-8190-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8190-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10604-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39324 · Security Note
• https://osv.dev/vulnerability/USN-8190-2 · Vendor Advisory
• https://github.com/rack/rack-session · Note