Race Condition Vulnerability in Rack Middleware for Ruby Web Applications

CVE-2025-32441

What is CVE-2025-32441?

The Rack framework, used for Ruby web applications, exhibits a vulnerability in its Rack::Session::Pool middleware that can result in unauthorized session restoration. This occurs due to race conditions present when multiple rack requests are processed simultaneously. If an attacker acquires a session cookie, they may exploit this issue by initiating a long-running request coinciding with a legitimate user logging out, thereby preserving access to the session even after logout attempts. It is crucial for developers to upgrade to version 2.2.14 or later, and consider implementing session invalidation practices, such as marking sessions as logged out or creating a custom session store to manage invalidation timestamps effectively.

References