CVE-2026-39324: Rack::Session::Cookie Decrypt Failure Fallback Vulnerability
Summary
CVE-2026-39324: Rack::Session::Cookie incorrectly handles decryption failures when configured with secrets:. Affects rack-session versions >= 2.0.0, < 2.1.2. Fixed in 2.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rack::Session::Cookie is a Ruby library that provides cookie-based session management for Rack applications. It allows developers to store session data in cookies, which are sent back and forth between the client and server. The library supports encryption and signing of session data to ensure its integrity and confidentiality. However, a vulnerability exists in how it handles decryption failures when configured with secrets, potentially allowing unauthorized access to session data.
Vulnerability Detail
The vulnerability arises from the incorrect handling of decryption failures in Rack::Session::Cookie when the 'secrets' configuration is used. If cookie decryption fails, instead of rejecting the cookie, the implementation falls back to a default decoder, which processes attacker-controlled cookie data as trusted session state. This behavior can lead to session forgery, where an unauthenticated attacker can supply a crafted session cookie that is accepted as valid, potentially allowing them to manipulate session contents and gain unauthorized access to the application.
How To Fix
Minimum fixed version
2.1.2
This is the first release that contains the fix.
gem install rack-session -v 2.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the use of 'secrets' in your Rack::Session::Cookie configuration, although this is not recommended as it reduces the security of session management. Instead, focus on updating to the patched version as soon as possible.
Conclusion
CVE-2026-39324 presents a significant security risk for applications using Rack::Session::Cookie with the 'secrets' configuration. It is crucial to update to the patched version to mitigate the risk of session forgery and unauthorized access. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for rack-session →
FAQ
CVE-2026-39324 is a vulnerability in Rack::Session::Cookie that allows session forgery due to improper handling of decryption failures.
Any Rack application using Rack::Session::Cookie with the 'secrets' configuration may be affected.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 9.1, indicating a critical severity level.
If you cannot update the package right away, consider disabling the use of 'secrets' in your configuration as a temporary workaround, but be aware that this reduces security.
References
Related vulnerabilities
Recent vulnerabilities recorded for rack-session.
