PT-2025-20314 · Rack+5 · Rack+5

Stengineering0

·

Published

2025-05-07

·

Updated

2025-11-02

·

CVE-2025-32441

CVSS v3.1

4.2

Medium

VectorAV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.2.14
Description The issue affects Rack, a modular Ruby web server interface, when using the Rack::Session::Pool middleware. Simultaneous rack requests can restore a deleted rack session, allowing an unauthenticated user to occupy that session. This occurs due to race conditions over concurrent rack requests. An attacker can exploit this by triggering a long-running request within the same session adjacent to the user logging out, retaining illicit access even after a user has attempted to logout.
Recommendations For versions prior to 2.2.14, ensure the application invalidates sessions atomically by marking them as logged out, e.g., using a logged out flag, instead of deleting them, and check this flag on every request to prevent reuse. Alternatively, implement a custom session store that tracks session invalidation timestamps and refuses to accept session data if the session was invalidated after the request began. Update to version 2.2.14, which contains a patch for the issue.

Exploit

Fix

DoS

Insufficient Session Expiration

Race Condition

Time Of Check To Time Of Use

Weakness Enumeration

Related Identifiers

BDU:2025-07359
CVE-2025-32441
DLA-4357-1
GHSA-VPFW-47H7-XJ4G
OPENSUSE-SU-2025_01586-1
SUSE-SU-2025:01586-1
SUSE-SU-2025:01586-2
SUSE-SU-2025:02329-1
SUSE-SU-2025:02330-1
SUSE-SU-2025:02429-1
SUSE-SU-2025:02564-1
SUSE-SU-2025_01586-1
SUSE-SU-2025_01586-2
SUSE-SU-2025_02329-1
SUSE-SU-2025_02330-1
SUSE-SU-2025_02429-1
SUSE-SU-2025_02564-1
USN-7507-1

Affected Products

Debian
Linuxmint
Rack
Red Os
Suse
Ubuntu