CVE catalog

CVE-2025-46336

UBUNTU-CVE-2025-46336

[CVE catalog]

Severity
Medium · CVSS 4.2CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.33% · Oct 25, 2026

Rack::Session is a session management implementation for Rack. In versions starting from 2.0.0 to before 2.1.1, when using the Rack::Session::Pool middleware, and provided the attacker can acquire a session cookie (already a major issue), the session may be restored if the attacker can trigger a long running request (within that same session) adjacent to the user logging out, in order to retain illicit access even after a user has attempted to logout. This issue has been patched in version 2.1.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianruby-rack-session132.1.1-0.1fixed
Debianruby-rack-session142.1.1-0.1fixed
Opensuserubygem-rack-sessiontumbleweed2.1.1-1.1fixed
Opensuserubygem-rack-sessiontumbleweed2.1.1-1.3fixed
Ubunturuby-rackpro2.0.6-3vulnerable
Ubunturuby-rackpro2.0.7-2vulnerable
Ubunturuby-rackpro2.0.7-2ubuntu0.1vulnerable
Ubunturuby-rackpro2.0.7-2ubuntu0.1+esm1vulnerable
Ubunturuby-rackpro2.0.7-2ubuntu0.1+esm2vulnerable
Ubunturuby-rackpro2.0.7-2ubuntu0.1+esm3vulnerable
Ubunturuby-rackpro2.0.7-2ubuntu0.1+esm4vulnerable
Ubunturuby-rackpro2.0.7-2ubuntu0.1+esm5vulnerable
Ubunturuby-rackpro2.0.7-2ubuntu0.1+esm6vulnerable
Ubunturuby-rackpro2.0.7-2ubuntu0.1+esm7vulnerable
Ubunturuby-rack22.042.1.4-3vulnerable
Ubunturuby-rack22.042.1.4-4vulnerable
Ubunturuby-rack22.042.1.4-5vulnerable
Ubunturuby-rack22.042.1.4-5ubuntu1vulnerable
Ubunturuby-rack22.042.1.4-5ubuntu1.1vulnerable
Ubunturuby-rack24.042.2.4-3vulnerable
Ubunturuby-rack24.042.2.7-1vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.1vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.2vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.3vulnerable
Ubunturuby-rack25.042.2.7-1.1vulnerable
Ubunturuby-rack25.042.2.7-1.1ubuntu0.25.04.1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianruby-rack-sessiondeb132.1.1-0.1Not reportedDEBIAN-CVE-2025-46336Not reported
Debianruby-rack-sessiondeb142.1.1-0.1Not reportedDEBIAN-CVE-2025-46336Not reported
Opensuserubygem-rack-sessionrpmtumbleweed2.1.1-1.1Not reportedOPENSUSE-SU-2025:15623-1Not reported
Opensuserubygem-rack-sessionrpmtumbleweed2.1.1-1.3Not reportedOPENSUSE-SU-2026:10359-1Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

[Debian 13 (Trixie)]

  • [ruby-rack-session]Fixed
    Details (3)

    • 2.1.1-0.1 · all · trixie

      Fixed · Fixed: 2.1.1-0.1

      pypi · ruby-rack-session · debian · 13

    • 2.1.1-0.1 · all · trixie

      Fixed · Fixed: 2.1.1-0.1

      pypi · ruby-rack-session · debian · 13

    • 2.1.1-0.1+deb13u1 · all · trixie-security

      Fixed · Fixed: 2.1.1-0.1

      pypi · ruby-rack-session · debian · 13

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]