CVE-2025-46336

Source
https://nvd.nist.gov/vuln/detail/CVE-2025-46336
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-46336.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-46336
Aliases
Downstream
Related
Published
2025-05-08T19:26:01Z
Modified
2025-10-10T19:16:56.746552Z
Severity
  • 4.2 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Rack session gets restored after deletion
Details

Rack::Session is a session management implementation for Rack. In versions starting from 2.0.0 to before 2.1.1, when using the Rack::Session::Pool middleware, and provided the attacker can acquire a session cookie (already a major issue), the session may be restored if the attacker can trigger a long running request (within that same session) adjacent to the user logging out, in order to retain illicit access even after a user has attempted to logout. This issue has been patched in version 2.1.1.

References

Affected packages

Git / github.com/rack/rack

Affected ranges

Type
GIT
Repo
https://github.com/rack/rack
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed

Affected versions

0.*

0.1
0.2
0.3

1.*

1.0
1.1
1.2
1.2.1
1.3.0
1.3.0.beta
1.3.0.beta2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.6.0.beta
1.6.0.beta2

2.*

2.0.0
2.0.0.alpha
2.0.0.rc1
2.0.1
2.1.0

Git / github.com/rack/rack

Affected ranges

Type
GIT
Repo
https://github.com/rack/rack-session
Events

Affected versions

v2.*

v2.0.0
v2.1.0