CVE-2026-39324 Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization

Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when configured with secrets:. If cookie decryption fails, the implementation falls back to a default decoder instead of rejecting the cookie...

CVE-2026-39324

CVE-2026-39324 affects Rack::Session::Cookie. From 2.0.0 up to 2.1.1, decryption failures under secrets: allow cookies to be decoded by a default coder instead of being rejected, enabling an unauthenticated attacker to forge session data and potentially gain unauthorized access. Affected componen...

CVE-2026-39324 Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization

Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when configured with secrets:. If cookie decryption fails, the implementation falls back to a default decoder instead of rejecting the cookie...

CVE-2026-39324 Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization

Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when configured with secrets:. If cookie decryption fails, the implementation falls back to a default decoder instead of rejecting the cookie...

CVE-2026-39324

Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when configured with secrets:. If cookie decryption fails, the implementation falls back to a default decoder instead of rejecting the cookie...

Exploit for CVE-2026-39324

CVE-2026-39324 Rack::Session::Cookie decrypt failure falls...

Linux Distros Unpatched Vulnerability : CVE-2026-39324

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when...

PT-2026-30806

Name of the Vulnerable Software and Affected Versions Rack::Session versions 2.0.0 through 2.1.1 Description Rack::Session is a session management implementation for Rack. Versions 2.0.0 through 2.1.1 incorrectly handle decryption failures when configured with secrets. If cookie decryption fails,...

CVE-2026-39324: Improper Authentication

Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when configured with secrets:. If cookie decryption fails, the implementation falls back to a default decoder instead of rejecting the cookie...

Rack::Session security vulnerability

Rack::Session is an open-source application developed by Official Rack repositories. Versions of Rack::Session prior to 2.1.2 contained security vulnerabilities. These vulnerabilities stemmed from improper handling of Cookie decryption failures, which could lead to session manipulation and...

Linux Distros Unpatched Vulnerability : CVE-2026-26962

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rack is a modular Ruby web server interface. From version 3.2.0 to before version 3.2.6, Rack::Multipart::Parser unfolds folded multipart part headers...

CVE-2025-32441 vulnerabilities

Vulnerabilities for packages: ruby3.4-rack, ruby3.3-rack, ruby3.2-rack, ruby4.0-rack...

GHSA-625H-95R8-8XPM vulnerabilities

Vulnerabilities for packages: ruby3.4-rack, ruby3.3-rack, ruby3.2-rack, ruby4.0-rack...

CVE-2025-59830 vulnerabilities

Vulnerabilities for packages: ruby3.4-rack, ruby3.3-rack, ruby3.2-rack, ruby4.0-rack...

GHSA-VPFW-47H7-XJ4G vulnerabilities

Vulnerabilities for packages: ruby3.4-rack, ruby3.3-rack, ruby3.2-rack, ruby4.0-rack...

Linux Distros Unpatched Vulnerability : CVE-2026-32762

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21 and 3.2.0 to before 3.2.6, Rack::Utils.forwardedvalues parses the RFC 72...

Linux Distros Unpatched Vulnerability : CVE-2026-34829

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser only wraps the request body in a BoundedIO whe...

Linux Distros Unpatched Vulnerability : CVE-2026-34763

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Directory interpolates the configured root path directly into a...

Linux Distros Unpatched Vulnerability : CVE-2026-34786

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Staticapplicablerules evaluates several headerrules types agains...

Linux Distros Unpatched Vulnerability : CVE-2026-34230

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.selectbestencoding processes Accept-Encoding values with...