Description
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby-rack | 1.4.1-2.1 | — |
| Debian 13 | ruby-rack | 1.4.1-2.1 | — |
| Debian 12 | ruby-rack | 1.4.1-2.1 | — |
| Debian 6.0 | librack-ruby | 1.1.0-4+squeeze1 | DSA-2783-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | ruby-rack | 1.5.2-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 1 | jenkins | 1.502-1.el6op | RHSA-2013:0638 |
| Red Hat OpenShift 1 | openshift-origin-cartridge-jenkins-1.4 | 1.0.3-1.el6op | RHSA-2013:0638 |
| Red Hat OpenShift 1 | ruby193-rubygem-rack | 1:1.4.1-4.el6 | RHSA-2013:0638 |
| Red Hat OpenShift 1 | rubygem-rack | 1:1.3.0-4.el6op | RHSA-2013:0638 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ruby3.2-rubygem-rack | 3.0.7-1.2 | openSUSE-SU-2024:13167-1 |
| openSUSE Tumbleweed | ruby3.2-rubygem-rack-2.2 | 2.2.7-1.1 | openSUSE-SU-2024:12974-1 |
| openSUSE Tumbleweed | rubyem-rack | 1.4.7-1.8 | openSUSE-SU-2024:10115-1 |
| openSUSE Tumbleweed | rubygem-rack | 2.2.3.1-1.1 | openSUSE-SU-2026:10358-1, openSUSE-SU-2025:14875-1, openSUSE-SU-2024:13726-1 |
| openSUSE Tumbleweed | rubygem-rack-2.2 | 2.2.4-1.1 | openSUSE-SU-2026:10286-1, openSUSE-SU-2025:14811-1, openSUSE-SU-2024:13727-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | rack | >= 1.5.0, < 1.5.2 | 1.5.2 | GHSA-xc85-32mf-xpv8 |
| RubyGems | rack | >= 1.4.0, < 1.4.5 | 1.4.5 | GHSA-xc85-32mf-xpv8 |
| RubyGems | rack | >= 1.3.0, < 1.3.10 | 1.3.10 | GHSA-xc85-32mf-xpv8 |
| RubyGems | rack | >= 1.2.0, < 1.2.8 | 1.2.8 | GHSA-xc85-32mf-xpv8 |
| RubyGems | rack | >= 1.1.0, < 1.1.6 | 1.1.6 | GHSA-xc85-32mf-xpv8 |
Advisories 13
- RHSA-2013:0638 Red Hat Security Advisory: Red Hat OpenShift Enterprise 1.1.2 update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- openSUSE-SU-2026:10286-1 ruby4.0-rubygem-rack-2.2-2.2.22-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2026:10358-1 ruby4.0-rubygem-rack-3.1.18-1.3 on GA media SUSE / openSUSE Security Updates · Mar 14, 2026
- DSA-2783-1 librack-ruby - several Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2025:14811-1 ruby3.4-rubygem-rack-2.2-2.2.11-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10115-1 ruby2.2-rubygem-rack-1_4-1.4.7-1.8 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13727-1 ruby3.3-rubygem-rack-2.2-2.2.8.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13167-1 ruby3.2-rubygem-rack-3.0.7-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12119-1 ruby3.1-rubygem-rack-2.2.3.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13726-1 ruby3.3-rubygem-rack-3.0.9.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12397-1 ruby3.1-rubygem-rack-2.2-2.2.4-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12974-1 ruby3.2-rubygem-rack-2.2-2.2.7-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14875-1 ruby3.4-rubygem-rack-3.1.12-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- 52774 third-party-advisory
- https://groups.google.com/forum/#%21msg/rack-devel/mZsuRonD7G8/DpZIOmMLbOgJ
- https://groups.google.com/forum/#%21msg/rack-devel/RnQxm6i13C4/xfakH81yWvgJ
- https://github.com/rack/rack/commit/9a81b961457805f6d1a5c275d053068440421e11
- 52033 third-party-advisory
- https://github.com/rack/rack/commit/0cd7e9aa397f8ebb3b8481d67dbac8b4863a7f07
- http://rack.github.com/
- 52134 third-party-advisory
- https://groups.google.com/d/msg/rack-devel/xKrHVWeNvDM/4ZGA576CnK4J
- https://bugzilla.redhat.com/show_bug.cgi?id=909071
- https://groups.google.com/forum/#%21msg/rack-devel/hz-liLb9fKE/8jvVWU6xYiYJ
- https://groups.google.com/forum/#%21msg/rack-devel/bf937jPZxJM/1s6x95vIhmAJ
- RHSA-2013:0686 vendor-advisory
- openSUSE-SU-2013:0462 vendor-advisory
- https://puppet.com/security/cve/cve-2013-0263
- https://gist.github.com/codahale/f9f3781f7b54985bee94
- https://twitter.com/coda/statuses/299732877745197056
- 89939 vdb-entry
- DSA-2783 vendor-advisory