Session Management Vulnerability in Ruby Rack: CVE-2025-46336
Summary
UBUNTU-CVE-2025-46336: Rack::Session is a session management implementation for Rack. Affects ruby-rack versions 1.5.2-1 – 1.5.2-3+deb8u3ubuntu1~esm9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby Rack is a modular Ruby web server interface that provides a simple and efficient way to build web applications. It includes middleware components for session management, among other functionalities. The Rack::Session module is responsible for managing user sessions, allowing developers to maintain state across requests. However, vulnerabilities in session management can lead to unauthorized access and data breaches, making it crucial to address any identified security issues promptly.
Vulnerability Detail
The vulnerability, identified as CVE-2025-46336, affects versions of Ruby Rack from 2.0.0 to before 2.1.1. It arises when using the Rack::Session::Pool middleware. An attacker who can obtain a session cookie can exploit this vulnerability by triggering a long-running request while a user is logging out. This can allow the attacker to retain access to the session even after the user has attempted to log out, posing a significant security risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement additional session management controls, such as invalidating session cookies upon logout or reducing the session timeout duration. However, the best approach is to update to the patched version as soon as possible.
Conclusion
CVE-2025-46336 is a critical vulnerability in Ruby Rack that can allow attackers to maintain session access after a user logs out. It is essential to update to the patched version 2.1.1 or later to secure your application. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for ruby-rack →
FAQ
CVE-2025-46336 is a security vulnerability in Ruby Rack that allows attackers to retain access to user sessions even after logout.
Versions from 2.0.0 to before 2.1.1 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to unauthorized access to user accounts and sensitive data, compromising the security of the application.
If immediate updates are not possible, consider implementing session management controls to mitigate the risk until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for ruby-rack.
