This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2025-46336 | BDVDB-2026-277997 Detail

rackrack-session

Description#

Rack::Session is a session management implementation for Rack. In versions starting from 2.0.0 to before 2.1.1, when using the Rack::Session::Pool middleware, and provided the attacker can acquire a session cookie (already a major issue), the session may be restored if the attacker can trigger a long running request (within that same session) adjacent to the user logging out, in order to retain illicit access even after a user has attempted to logout. This issue has been patched in version 2.1.1.

Impact#

Per CVSS v3.1: confidentiality impact low, integrity impact low, availability impact none. Attack vector: network.

Weaknesses#

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
  • CWE-613 Insufficient Session Expiration

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.