{
  "cveId": "CVE-2025-32441",
  "url": "https://patchblox.com/security/cve/CVE-2025-32441",
  "summary": "CVE-2025-32441 is fixed in 3 products on 1 platform, first by ruby-rack 1.6.4-4ubuntu0.2\u002Besm8, released May 7, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "ruby-rack: Rack is a modular Ruby web server interface",
  "description": "Rack is a modular Ruby web server interface. Prior to version 2.2.14, whenusing the \u0060Rack::Session::Pool\u0060 middleware, simultaneous rack requests canrestore a deleted rack session, which allows the unauthenticated user tooccupy that session. Rack session middleware prepares the session at thebeginning of request, then saves is back to the store with possible changesapplied by host rack application. This way the session becomes to be asubject of race conditions in general sense over concurrent rack requests.When using the \u0060Rack::Session::Pool\u0060 middleware, and provided the attackercan acquire a session cookie (already a major issue), the session may berestored if the attacker can trigger a long running request (within thatsame session) adjacent to the user logging out, in order to retain illicitaccess even after a user has attempted to logout. Version 2.2.14 contains apatch for the issue. Some other mitigations are available. Either ensurethe application invalidates sessions atomically by marking them as loggedout e.g., using a \u0060logged_out\u0060 flag, instead of deleting them, and checkthis flag on every request to prevent reuse; or implement a custom sessionstore that tracks session invalidation timestamps and refuses to acceptsession data if the session was invalidated after the request began.",
  "published": "2025-05-07T17:00:00Z",
  "severity": "Medium",
  "cvss": 4.2,
  "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "epss": 0.00284,
  "epssPercentile": 0.21036,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "rmt-server",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "2.23-150500.3.34.2",
      "fix": "SUSE-SU-2025:02564-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-02564-1",
      "released": "2025-07-31T06:26:40Z"
    },
    {
      "platform": "linux",
      "product": "rmt-server",
      "release": "sles 15.6",
      "fixedVersion": "2.23-150500.3.34.2",
      "fix": "SUSE-SU-2025:02564-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-02564-1",
      "released": "2025-07-31T06:26:40Z"
    },
    {
      "platform": "linux",
      "product": "rmt-server",
      "release": "sles 15.7",
      "fixedVersion": "2.23-150700.3.6.1",
      "fix": "SUSE-SU-2025:02330-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-02330-1",
      "released": "2025-07-16T11:10:11Z"
    },
    {
      "platform": "linux",
      "product": "ruby-rack",
      "release": "Debian 11.6 (bullseye)",
      "fixedVersion": "2.1.4-3\u002Bdeb11u4",
      "fix": "DLA-4357-1",
      "url": "https://patchblox.com/security/fix/linux/dla-4357-1",
      "released": "2025-11-01T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-rack",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "2.2.20-0\u002Bdeb12u1",
      "fix": "DEBIAN-CVE-2025-32441",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-32441",
      "released": "2025-05-07T23:15:53Z"
    },
    {
      "platform": "linux",
      "product": "ruby-rack",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "3.0.8-2",
      "fix": "DEBIAN-CVE-2025-32441",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-32441",
      "released": "2025-05-07T23:15:53Z"
    },
    {
      "platform": "linux",
      "product": "ruby-rack",
      "release": "Debian 14",
      "fixedVersion": "3.0.8-2",
      "fix": "DEBIAN-CVE-2025-32441",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-32441",
      "released": "2025-05-07T23:15:53Z"
    },
    {
      "platform": "linux",
      "product": "ruby-rack",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1.6.4-4ubuntu0.2\u002Besm8",
      "fix": "ruby-rack 1.6.4-4ubuntu0.2\u002Besm8",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-ruby-rack-1.6.4-4ubuntu0.2-esm8",
      "released": "2025-05-07T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-rack",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "2.0.7-2ubuntu0.1\u002Besm7",
      "fix": "ruby-rack 2.0.7-2ubuntu0.1\u002Besm7",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-ruby-rack-2.0.7-2ubuntu0.1-esm7",
      "released": "2025-05-07T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-rack",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2.1.4-5ubuntu1.1\u002Besm2",
      "fix": "ruby-rack 2.1.4-5ubuntu1.1\u002Besm2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-ruby-rack-2.1.4-5ubuntu1.1-esm2",
      "released": "2025-05-07T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-rack",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "2.2.7-1ubuntu0.3",
      "fix": "ruby-rack 2.2.7-1ubuntu0.3",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-ruby-rack-2.2.7-1ubuntu0.3",
      "released": "2025-05-07T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-rack",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "2.2.7-1.1ubuntu0.2",
      "fix": "ruby-rack 2.2.7-1.1ubuntu0.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-ruby-rack-2.2.7-1.1ubuntu0.2",
      "released": "2025-05-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-rack",
      "release": "Ubuntu 25.04 (plucky)",
      "fixedVersion": "2.2.7-1.1ubuntu0.25.04.1",
      "fix": "ruby-rack 2.2.7-1.1ubuntu0.25.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-plucky-ruby-rack-2.2.7-1.1ubuntu0.25.04.1",
      "released": "2025-05-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-rack",
      "release": "Ubuntu 25.10 (questing)",
      "fixedVersion": "3.1.16-0.1",
      "fix": "ruby-rack 3.1.16-0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-questing-ruby-rack-3.1.16-0.1",
      "released": "2025-05-07T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-rack",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "3.1.16-0.1",
      "fix": "ruby-rack 3.1.16-0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-ruby-rack-3.1.16-0.1",
      "released": "2025-05-07T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "rubygem-rack",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "2.0.8-150000.3.31.1",
      "fix": "SUSE-SU-2025:01586-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-01586-1",
      "released": "2025-05-19T17:23:40Z"
    },
    {
      "platform": "linux",
      "product": "rubygem-rack",
      "release": "sles 15.6",
      "fixedVersion": "2.0.8-150000.3.31.1",
      "fix": "SUSE-SU-2025:01586-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-01586-1",
      "released": "2025-05-19T17:23:40Z"
    },
    {
      "platform": "linux",
      "product": "rubygem-rack",
      "release": "sles 15.7",
      "fixedVersion": "2.0.8-150000.3.31.1",
      "fix": "SUSE-SU-2025:01586-2",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-01586-2",
      "released": "2025-06-03T09:17:02Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}