CVE-2025-46336

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-46336
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-46336.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-46336
Aliases
Related
Published
2025-05-08T20:15:30Z
Modified
2025-05-18T03:33:29.203638Z
Summary
[none]
Details

Rack::Session is a session management implementation for Rack. In versions starting from 2.0.0 to before 2.1.1, when using the Rack::Session::Pool middleware, and provided the attacker can acquire a session cookie (already a major issue), the session may be restored if the attacker can trigger a long running request (within that same session) adjacent to the user logging out, in order to retain illicit access even after a user has attempted to logout. This issue has been patched in version 2.1.1.

References

Affected packages

Debian:13 / ruby-rack-session

Package

Name
ruby-rack-session
Purl
pkg:deb/debian/ruby-rack-session?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.3.0-1

2.*

2.0.0-1
2.0.0-1+exp1
2.0.0-2
2.0.0-3
2.1.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/rack/rack

Affected ranges

Type
GIT
Repo
https://github.com/rack/rack
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
799a520a015de5938bc01faa8e90b76589c6e7d3
Type
GIT
Repo
https://github.com/rack/rack-session
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
96663ece1596a3462704c30f98b85cd7e0337d6e

Affected versions

0.*

0.1
0.2
0.3

1.*

1.0
1.1
1.2
1.2.1
1.3.0
1.3.0.beta
1.3.0.beta2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.6.0.beta
1.6.0.beta2

2.*

2.0.0
2.0.0.alpha
2.0.0.rc1
2.0.1
2.1.0

v0.*

v0.1.0
v0.2.0
v0.2.1
v0.3.0

v1.*

v1.0.0

v2.*

v2.0.0
v2.1.0