CRITICALRubyGems
GHSA-33qg-7wpp-89cq· CVE-2026-39324Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization
Modified: 9/10/2026
package
RubyGems/rack-session
pkg:rubygems/rack-session
MEDIUM4.2RubyGems
GHSA-9j94-67jr-4cqj· CVE-2025-46336Rack session gets restored after deletion
Modified: 9/10/2026