CVE-2012-2671: The Rack::Cache rubygem 0.3.0 through 1.1 caches Set-Cookie and other sensitive headers, which allows attac...

Security readout for executives and security teams

Rack::Cache 0.3.0 through 1.1 could store Set-Cookie and other sensitive headers in cache. If cached responses were reachable by another user, that user could obtain session cookies and potentially take over web sessions. Business risk depends on whether affected Rack applications used Rack::Cache for authenticated or personalized responses. Exposure is most likely in older Ruby Rack deployments using Rack::Cache 0.3.0 through 1.1, especially where authenticated responses, session cookies, or shared caches were present. Evidence in the bundle does not identify specific downstream applications beyond the Rack::Cache gem and vendor packaging references. Prioritize remediation where legacy Ruby applications handle logins, customer portals, or admin sessions. The CVSS score is unavailable, but the business impact can be serious because exposed session cookies can bypass normal authentication controls. Mitigation focus: Identify deployments using Rack::Cache versions 0.3.0 through 1.1.; Move affected deployments to a vendor-supported fixed Rack::Cache package or release.; Review upstream commit and distribution advisories before selecting the target version..

Prepared

Jun 24, 2026, 12:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.