CVE-2013-0263
Rack arbitrary code execution via timing attack
CVE-2013-0263 is a medium vulnerability (CVSS 5.1) in Rack Project Rack, published February 8, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.38%, the 92nd percentile. Fixed in rack 1.5.2.
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
Exploit likelihood
What each source reports
NVD Score used
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
- Record
CVE-2013-0263- CVSS 2.0
- 5.1 Medium
AV:N/AC:H/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
- Record
CVE-2013-0263- Updated
- 2026-11-02
EUVDEUVD-2022-5763 No score
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
- Record
EUVD-2022-5763- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xc85-32mf-xpv8 No score
Rack arbitrary code execution via timing attack
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
- Record
GHSA-xc85-32mf-xpv8- Updated
- 2026-11-02
OSV No score
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
- Record
CVE-2013-0263- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-0263 No score
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
- Record
DEBIAN-CVE-2013-0263- Updated
- 2026-11-02
Show 17 moreShow less
OSVGHSA-xc85-32mf-xpv8 No score
Rack arbitrary code execution via timing attack
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
- Record
GHSA-xc85-32mf-xpv8- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10115-1 No score
ruby2.2-rubygem-rack-1_4-1.4.7-1.8 on GA media
These are all security issues fixed in the ruby2.2-rubygem-rack-1_4-1.4.7-1.8 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10115-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10406-1 No score
ruby2.2-rubygem-rack-1_6-1.6.5-1.1 on GA media
These are all security issues fixed in the ruby2.2-rubygem-rack-1_6-1.6.5-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10406-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11344-1 No score
ruby2.7-rubygem-rack-2.2.3-1.7 on GA media
These are all security issues fixed in the ruby2.7-rubygem-rack-2.2.3-1.7 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11344-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11345-1 No score
ruby2.7-rubygem-rack-1_6-1.6.13-1.13 on GA media
These are all security issues fixed in the ruby2.7-rubygem-rack-1_6-1.6.13-1.13 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11345-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11346-1 No score
ruby2.7-rubygem-rack-2.0-2.0.9-1.10 on GA media
These are all security issues fixed in the ruby2.7-rubygem-rack-2.0-2.0.9-1.10 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11346-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12119-1 No score
ruby3.1-rubygem-rack-2.2.3.1-1.1 on GA media
These are all security issues fixed in the ruby3.1-rubygem-rack-2.2.3.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12119-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12397-1 No score
ruby3.1-rubygem-rack-2.2-2.2.4-1.1 on GA media
These are all security issues fixed in the ruby3.1-rubygem-rack-2.2-2.2.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12397-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12974-1 No score
ruby3.2-rubygem-rack-2.2-2.2.7-1.1 on GA media
These are all security issues fixed in the ruby3.2-rubygem-rack-2.2-2.2.7-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12974-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13167-1 No score
ruby3.2-rubygem-rack-3.0.7-1.2 on GA media
These are all security issues fixed in the ruby3.2-rubygem-rack-3.0.7-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13167-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13726-1 No score
ruby3.3-rubygem-rack-3.0.9.1-1.1 on GA media
These are all security issues fixed in the ruby3.3-rubygem-rack-3.0.9.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13726-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13727-1 No score
ruby3.3-rubygem-rack-2.2-2.2.8.1-1.1 on GA media
These are all security issues fixed in the ruby3.3-rubygem-rack-2.2-2.2.8.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13727-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14811-1 No score
ruby3.4-rubygem-rack-2.2-2.2.11-1.1 on GA media
These are all security issues fixed in the ruby3.4-rubygem-rack-2.2-2.2.11-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14811-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14875-1 No score
ruby3.4-rubygem-rack-3.1.12-1.1 on GA media
These are all security issues fixed in the ruby3.4-rubygem-rack-3.1.12-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14875-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10286-1 No score
ruby4.0-rubygem-rack-2.2-2.2.22-1.1 on GA media
These are all security issues fixed in the ruby4.0-rubygem-rack-2.2-2.2.22-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10286-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10358-1 No score
ruby4.0-rubygem-rack-3.1.18-1.3 on GA media
These are all security issues fixed in the ruby4.0-rubygem-rack-3.1.18-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10358-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-0263 No score
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
- Record
UBUNTU-CVE-2013-0263- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rackRubyGems |
1.5.0 up to 1.5.2 | 1.5.2 |
rackRubyGems |
1.4.0 up to 1.4.5 | 1.4.5 |
rackRubyGems |
1.3.0 up to 1.3.10 | 1.3.10 |
rackRubyGems |
1.2.0 up to 1.2.8 | 1.2.8 |
rackRubyGems |
1.1.0 up to 1.1.6 | 1.1.6 |
ruby-rackDebian:12 |
before 1.4.1-2.1 | 1.4.1-2.1 |
ruby-rackDebian:13 |
before 1.4.1-2.1 | 1.4.1-2.1 |
ruby-rackDebian:14 |
before 1.4.1-2.1 | 1.4.1-2.1 |
librack-rubyDebian:6.0 |
before 1.1.0-4+squeeze1, plus listed versions 1.1.0-4 |
1.1.0-4+squeeze1 |
rackRubyGems |
1.5.0 up to 1.5.2, plus listed versions 1.5.1 |
1.5.2 |
Show 20 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rackRubyGems |
1.4.0 up to 1.4.5, plus listed versions 1.4.11.4.21.4.31.4.4 |
1.4.5 |
rackRubyGems |
1.3.0 up to 1.3.10, plus listed versions 1.3.11.3.21.3.31.3.41.3.5 Show 4 moreShow less1.3.61.3.71.3.81.3.9 |
1.3.10 |
rackRubyGems |
1.2.0 up to 1.2.8, plus listed versions 1.2.11.2.21.2.31.2.41.2.51.2.61.2.7 |
1.2.8 |
rackRubyGems |
1.1.0 up to 1.1.6, plus listed versions 1.1.11.1.1.pre1.1.21.1.31.1.41.1.5 |
1.1.6 |
ruby193-rubygem-rackRed Hat:openshift:1::el6 |
before 1:1.4.1-4.el6 | 1:1.4.1-4.el6 |
rubygem-rackRed Hat:openshift:1::el6 |
before 1:1.3.0-4.el6op | 1:1.3.0-4.el6op |
jenkinsRed Hat:openshift:1::el6 |
before 0:1.502-1.el6op | 0:1.502-1.el6op |
openshift-origin-cartridge-jenkins-1.4Red Hat:openshift:1::el6 |
before 0:1.0.3-1.el6op | 0:1.0.3-1.el6op |
ruby-rackUbuntu:14.04:LTS |
before 1.5.2-1 | 1.5.2-1 |
rubyem-rackopenSUSE:Tumbleweed |
before 1.4.7-1.8 | 1.4.7-1.8 |
rubygem-rackopenSUSE:Tumbleweed |
before 2.2.3.1-1.1 | 2.2.3.1-1.1 |
rubygem-rack-2.2openSUSE:Tumbleweed |
before 2.2.4-1.1 | 2.2.4-1.1 |
ruby3.2-rubygem-rack-2.2openSUSE:Tumbleweed |
before 2.2.7-1.1 | 2.2.7-1.1 |
ruby3.2-rubygem-rackopenSUSE:Tumbleweed |
before 3.0.7-1.2 | 3.0.7-1.2 |
rubygem-rackopenSUSE:Tumbleweed |
before 3.0.9.1-1.1 | 3.0.9.1-1.1 |
rubygem-rack-2.2openSUSE:Tumbleweed |
before 2.2.8.1-1.1 | 2.2.8.1-1.1 |
rubygem-rack-2.2openSUSE:Tumbleweed |
before 2.2.11-1.1 | 2.2.11-1.1 |
rubygem-rackopenSUSE:Tumbleweed |
before 3.1.12-1.1 | 3.1.12-1.1 |
rubygem-rack-2.2openSUSE:Tumbleweed |
before 2.2.22-1.1 | 2.2.22-1.1 |
rubygem-rackopenSUSE:Tumbleweed |
before 3.1.18-1.3 | 3.1.18-1.3 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
secunia.com/advisories/52774
groups.google.com/forum
github.com/rack/rack/commit/9a81b961457805f6d1a5c275d053068440421e11
rack.github.com
Show 75 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=909071
rhn.redhat.com/errata/RHSA-2013-0686.html
lists.opensuse.org/opensuse-updates/2013-03/msg00048.html
puppet.com/security/cve/cve-2013-0263
gist.github.com/codahale/f9f3781f7b54985bee94
twitter.com/coda/statuses/299732877745197056
osvdb.org/89939
debian.org/security/2013/dsa-2783
nvd.nist.gov/vuln/detail/CVE-2013-0263
security-tracker.debian.org/tracker/CVE-2013-0263
access.redhat.com/errata/RHSA-2013:0638
wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0638.json
cve.org/CVERecord?id=CVE-2013-0262
ubuntu.com/security/CVE-2013-0263
openwall.com/lists/oss-security/2013/02/07
suse.com/security/cve/CVE-2013-0262