PT-2026-30806 · Unknown · Rack::Session

Sm1Ee · CVE-2026-39324 · Published 2026-04-07 · Updated 2026-04-28

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Rack::Session versions 2.0.0 through 2.1.1

Description Rack::Session is a session management implementation for Rack. Versions 2.0.0 through 2.1.1 incorrectly handle decryption failures when configured with secrets. If cookie decryption fails, the implementation falls back to a default decoder instead of rejecting the cookie. This allows an unauthenticated attacker to supply a crafted session cookie that is accepted as valid session data without knowledge of any configured secret. An attacker can manipulate session contents and potentially gain unauthorized access.

Recommendations Update Rack::Session to version 2.1.2 or later.

Exploit

Fix

RCE

Insufficient Verification of Data Authenticity

Improper Authentication

Deserialization of Untrusted Data

Weakness Enumeration

CWE-345

CWE-565

CWE-287

CWE-502

Related Identifiers

BDU:2026-09334

CVE-2026-39324

GHSA-33QG-7WPP-89CQ

OPENSUSE-SU-2026:10604-1

USN-8190-1

USN-8190-2

Affected Products

Rack::Session

References · 28

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39324.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack-session/CVE-2026-39324.yml · Exploit
• https://github.com/rack/rack-session/security/advisories/GHSA-33qg-7wpp-89cq · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-39324 · Security Note
• https://bdu.fstec.ru/vul/2026-09334 · Security Note
• https://osv.dev/vulnerability/USN-8190-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-39324 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-33qg-7wpp-89cq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-39324 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8190-2 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-39324 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8190-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39324 · Security Note
• https://osv.dev/vulnerability/USN-8190-2 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10604-1 · Vendor Advisory