CVE-2026-39324 is a critical flaw (CVSS 9.8) in Rack::Session::Cookie from the rack-session gem. When decryption of a session cookie fails, it falls back to a default decoder instead of rejecting the cookie, so a crafted cookie can be accepted. Versions 2.0.0 up to 2.1.2 are affected, and 2.1.2 fixes it.
What's affected
rack-session from 2.0.0 to before 2.1.2 is affected when Rack::Session::Cookie is configured with secrets:. The fixed version is 2.1.2.
Rails apps use rack-session through their stack, so check the resolved gem version rather than only your Gemfile.
How to check if you're exposed
bundle list | grep rack-session
bundle exec gem list rack-session
grep -n "rack-session" Gemfile.lock
Then search your code for cookie session configuration that passes secrets:.
What to do now
- Run
bundle update rack-sessionand confirm 2.1.2 or later in Gemfile.lock. - Redeploy every service and image that bundles the gem.
- Review whether any authorization decision trusts values stored in the session cookie.
- Consider rotating session secrets and invalidating existing sessions after the upgrade.
After patching, run the free in-browser dependency scan at gold.safeguard.sh/scan to find other copies of the affected package. Reachability analysis then helps you decide which findings in your own code deserve attention first.
Why it matters
The record lists four weakness classes: CWE-287 (Improper Authentication), CWE-345 (Insufficient Verification of Data Authenticity), CWE-502 (Deserialization of Untrusted Data) and CWE-565 (Reliance on Cookies without Validation and Integrity Checking). The core problem is plain. A cookie that fails to decrypt should be rejected. Here it is decoded by a fallback path, which means the secret no longer protects the session contents.
Because session state decides who a user is, forged contents can lead to unauthorized access. No authentication is needed (PR:N). The record does not flag this CVE as exploited in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Am I affected if I do not set secrets:?
The advisory describes the flaw for Rack::Session::Cookie configured with secrets:. Upgrade anyway.
What is the fixed version?
rack-session 2.1.2.
Sources
Scan your own dependencies for free at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
