CVE-2025-46336: rack rack-session Race Condition

Vulnerability summary

CVE-2025-46336 is a medium (CVSS 4.2) Race Condition vulnerability in rack rack-session. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.9% of scored vulnerabilities.

Timeline

1. 08-05-2025
   PublishedVulnerability first disclosed.
2. 08-05-2025
   Last modifiedVulnerability information updated.

Description

Rack::Session is a session management implementation for Rack. In versions starting from 2.0.0 to before 2.1.1, when using the Rack::Session::Pool middleware, and provided the attacker can acquire a session cookie (already a major issue), the session may be restored if the attacker can trigger a long running request (within that same session) adjacent to the user logging out, in order to retain illicit access even after a user has attempted to logout. This issue has been patched in version 2.1.1.

• CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
• CWE-367Time-of-check Time-of-use (TOCTOU) Race ConditionThe product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
• CWE-613Insufficient Session ExpirationAccording to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."