CRITICAL🇵🇱 Wersja polska

CVE-2026-39324

CVSS 9.3v4.0pub. 2026-04-07upd. 2026-04-15

Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when configured with secrets:. If cookie decryption fails, the implementation falls back to a default decoder instead of rejecting the cookie. This allows an unauthenticated attacker to supply a crafted session cookie that is accepted as valid session data without knowledge of any configured secret. Because this mechanism is used to load session state, an attacker can manipulate session contents and potentially gain unauthorized access. This vulnerability is fixed in 2.1.2.

🤖 AI Analysis
How it works

When secrets are configured and decryption of the session cookie fails, the implementation instead of rejecting the cookie, falls back to the default decoder. An attacker can therefore provide a crafted session cookie that will be accepted and processed without knowledge of the configured secret. Since this mechanism is used to load session state, the attacker gains control over the session content.

Impact

An attacker can manipulate web application session data and gain unauthorized access to resources or functions requiring authentication. It is also possible to escalate privileges by substituting session content.

Mitigation & patch

The rack-session library should be updated to version 2.1.2 or newer, where the vulnerability has been fixed.

Who is affected

Rack::Session (rack-session) in versions from 2.0.0 to 2.1.1 (before 2.1.2)

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • Rack Session

    APP
    Rack
    2.0.0 – 2.1.2 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth BypassDeserialization
CWE
References

Related vulnerabilities

CVE-2026-34785HIGH7.5same vendor

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determi...

CVE-2026-34829HIGH7.5same vendor

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Par...

CVE-2026-34827HIGH7.5same vendor

Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3...

CVE-2026-22860HIGH7.5same vendor

Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s ...

CVE-2025-61919HIGH7.5same vendor

Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, `Rack::Request#POST`...