{"action":"Upgrade rack-session to 2.1.2 or later.","affected":[{"fixed":"2.1.2","introduced":"2.0.0"}],"component":"rack-session","cve_ids":["CVE-2026-39324"],"ecosystem":"RubyGems","epss":0.0027,"exploited":false,"fixed_versions":["2.1.2"],"ghsa_id":"GHSA-33qg-7wpp-89cq","id":"tcs_01M5KEG5071D6V346Y60VBAZ3P","modified_at":"2026-09-10T03:50:42.369413216Z","published_at":"2026-04-08T00:15:08Z","references":["https://osv.dev/vulnerability/GHSA-33qg-7wpp-89cq","https://github.com/rack/rack-session/security/advisories/GHSA-33qg-7wpp-89cq","https://nvd.nist.gov/vuln/detail/CVE-2026-39324","https://github.com/rack/rack-session","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack-session/CVE-2026-39324.yml"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-33qg-7wpp-89cq","url":"https://osv.dev/vulnerability/GHSA-33qg-7wpp-89cq"},{"source":"nvd","source_id":"CVE-2026-39324","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39324"}],"summary":"Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization"}