rack-session vulnerabilities and fixes

Recent CVEs affecting rack-session, with upgrade or downgrade steps. 1 tracked.

Also searched as: rack session.

rack-session has 1 tracked vulnerability, 1 critical. A fixed release or vendor patch exists for 1. Most recent: 2026-04-07. Highest priority: CVE-2026-39324 (score 44/100).

• CVE-2026-39324 CRITICAL 9.8 UPGRADE Rack::Session is a session management implementation for Rack

FAQ

How do I fix rack-session vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is rack-session being exploited right now?

None of the tracked rack-session CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which rack-session CVE should I patch first?

CVE-2026-39324 currently ranks highest (44/100): Rack::Session is a session management implementation for Rack.

← Back to latest CVEs