Skip to content
OpenAdvisories
Critical USN-8190-1 1 CVE

ruby-rack-session vulnerability

Published Apr 20, 2026 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

SeungMyung Lee discovered that Rack::Session did not properly reject
cookies upon decryption failure. A remote attacker could use this issue to
manipulate session contents and possibly gain unauthorized access.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 25.10 ruby-rack-session 2.1.1-0.1ubuntu0.1

Vulnerabilities 1

  • Critical 9.3
    CVE-2026-39324 Public exploit

    Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization

    Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when configured with secrets:. If cookie decryption fails, the implementation falls back to a default deco…

    rack rack-session logstash-9.3 logstash-9.3-iamguarded-compat Debian Ubuntu Wolfi RubyGems

References

  • report
    https://ubuntu.com/security/CVE-2026-39324