CVE-2025-46336 - CVE House
Back to Database
Status published Medium CVE-2025-46336

Rack session gets restored after deletion

Vulnerability Description

Rack::Session is a session management implementation for Rack. In versions starting from 2.0.0 to before 2.1.1, when using the Rack::Session::Pool middleware, and provided the attacker can acquire a session cookie (already a major issue), the session may be restored if the attacker can trigger a long running request (within that same session) adjacent to the user logging out, in order to retain illicit access even after a user has attempted to logout. This issue has been patched in version 2.1.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-46336

Credits & Attribution

No credits recorded in the NVD database.

References

More from rack

View All →
CVE-2025-61919
Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing
High 7.5
CVE-2025-61780
Rack has Possible Information Disclosure Vulnerability
Medium 5.8
CVE-2025-61772
Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
High 7.5
CVE-2025-61771
Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
High 7.5
CVE-2025-61770
Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)
High 7.5

Affected Vendor

Affected Software

rack-session
Vulnerable Versions:
>= 2.0.0, < 2.1.1

Timeline

Official Publish: May 8th, 2025
Last Modified: May 8th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-362 CWE-367 CWE-613

MITRE ATT&CK TTPs

T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1574 Hijack Execution Flow
Persistence
T1565 Data Manipulation
Impact
T1499 Endpoint Denial of Service
Impact
T1190 Exploit Public-Facing Application
Initial Access
T1036 Masquerading
Defense Evasion
T1485 Data Destruction
Impact
T1005 Data from Local System
Collection
T1539 Steal Web Session Cookie
Credential Access
T1078 Valid Accounts
Persistence
T1550 Use Alternate Authentication Material
Defense Evasion
T1021 Remote Services
Lateral Movement
T1562 Impair Defenses
Defense Evasion