rack-session
A session implementation for Rack.
View on Github
Activity
- Latest release
- 5mo ago
- Total releases
- 11
- Cadence
- ~4 months
- Last 12 months
- 1
Reach
- Stars
- —
Details
- License
- MIT
- First release
- Feb 17, 2022
| Version | Released | |
|---|---|---|
2.1.2
patch
|
2.1.2
patch
Dependencies (7)
Changelog
Compare changes
|
|
2.1.1
patch
1 CVE
CVE-2026-39324
GHSA-33qg-7wpp-89cq
Apr 08, 2026
Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization
Critical
Network
Low
None
None
Because this mechanism is used to load session state, an attacker can manipulate session contents and potentially gain unauthorized access. DetailsWhen This fallback path processes attacker-controlled cookie data as trusted session state. The behavior is implicit and occurs even when encrypted cookies are expected. The fallback decoder is applied automatically and does not require the application to opt into a non-encrypted session format. As a result, a client can send a specially crafted cookie value that bypasses the intended integrity protections provided by This issue affects both default configurations and those using alternative serializers for encrypted payloads. ImpactAny Rack application using
An unauthenticated attacker can supply a crafted session cookie that is accepted as valid session data. This can lead to authentication bypass or privilege escalation in applications that rely on session values for identity or authorization decisions. Depending on application behavior and available runtime components, processing of untrusted session data may also expose additional risks. Mitigation
Affected versions
2.0.0
2.1.0
2.1.1
Fixed in
2.1.2
References Updated Sep 10, 2026 · Source: OSV.dev |
2.1.1
patch
Dependencies (7)
Changelog
Compare changes
|
|
2.1.0
minor
2 CVEs
CVE-2026-39324
GHSA-33qg-7wpp-89cq
Apr 08, 2026
Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization
Critical
Network
Low
None
None
Because this mechanism is used to load session state, an attacker can manipulate session contents and potentially gain unauthorized access. DetailsWhen This fallback path processes attacker-controlled cookie data as trusted session state. The behavior is implicit and occurs even when encrypted cookies are expected. The fallback decoder is applied automatically and does not require the application to opt into a non-encrypted session format. As a result, a client can send a specially crafted cookie value that bypasses the intended integrity protections provided by This issue affects both default configurations and those using alternative serializers for encrypted payloads. ImpactAny Rack application using
An unauthenticated attacker can supply a crafted session cookie that is accepted as valid session data. This can lead to authentication bypass or privilege escalation in applications that rely on session values for identity or authorization decisions. Depending on application behavior and available runtime components, processing of untrusted session data may also expose additional risks. Mitigation
Affected versions
2.0.0
2.1.0
2.1.1
Fixed in
2.1.2
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2025-46336
GHSA-9j94-67jr-4cqj
May 08, 2025
Rack session gets restored after deletion
4.2
/ 10
Medium
Network
High
Low
None
Unchanged
Low
Low
None
SummaryWhen using the DetailsRack session middleware prepares the session at the beginning of request, then saves is back to the store with possible changes applied by host rack application. This way the session becomes to be a subject of race conditions in general sense over concurrent rack requests. ImpactWhen using the Mitigation
RelatedThis code was previously part of Affected versions
2.0.0
2.1.0
Fixed in
2.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
2.1.0
minor
Dependencies (7)
Changelog
Compare changes
|
|
1.0.2
patch
| ||
1.0.0
major
| ||
2.0.0
major
2 CVEs
CVE-2026-39324
GHSA-33qg-7wpp-89cq
Apr 08, 2026
Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization
Critical
Network
Low
None
None
Because this mechanism is used to load session state, an attacker can manipulate session contents and potentially gain unauthorized access. DetailsWhen This fallback path processes attacker-controlled cookie data as trusted session state. The behavior is implicit and occurs even when encrypted cookies are expected. The fallback decoder is applied automatically and does not require the application to opt into a non-encrypted session format. As a result, a client can send a specially crafted cookie value that bypasses the intended integrity protections provided by This issue affects both default configurations and those using alternative serializers for encrypted payloads. ImpactAny Rack application using
An unauthenticated attacker can supply a crafted session cookie that is accepted as valid session data. This can lead to authentication bypass or privilege escalation in applications that rely on session values for identity or authorization decisions. Depending on application behavior and available runtime components, processing of untrusted session data may also expose additional risks. Mitigation
Affected versions
2.0.0
2.1.0
2.1.1
Fixed in
2.1.2
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2025-46336
GHSA-9j94-67jr-4cqj
May 08, 2025
Rack session gets restored after deletion
4.2
/ 10
Medium
Network
High
Low
None
Unchanged
Low
Low
None
SummaryWhen using the DetailsRack session middleware prepares the session at the beginning of request, then saves is back to the store with possible changes applied by host rack application. This way the session becomes to be a subject of race conditions in general sense over concurrent rack requests. ImpactWhen using the Mitigation
RelatedThis code was previously part of Affected versions
2.0.0
2.1.0
Fixed in
2.1.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.0.1
patch
| ||
0.3.0
minor
| ||
0.2.1
patch
| ||
0.2.0
minor
| ||
0.1.0
initial
|