Rack is a modular Ruby web server interface. Prior to version 2.2.14, when using the `Rack::Session::Pool` middleware, simultaneous rack requests can restore a deleted rack session, which allows the unauthenticated user to occupy that session. Rack session middleware prepares the session at the beginning of request, then saves is back to the store with possible changes applied by host rack application. This way the session becomes to be a subject of race conditions in general sense over concurrent rack requests. When using the `Rack::Session::Pool` middleware, and provided the attacker can acquire a session cookie (already a major issue), the session may be restored if the attacker can trigger a long running request (within that same session) adjacent to the user logging out, in order to retain illicit access even after a user has attempted to logout. Version 2.2.14 contains a patch for the issue. Some other mitigations are available. Either ensure the application invalidates sessions atomically by marking them as logged out e.g., using a `logged_out` flag, instead of deleting them, and check this flag on every request to prevent reuse; or implement a custom session store that tracks session invalidation timestamps and refuses to accept session data if the session was invalidated after the request began.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-a35addbf9b advisory.

    Update to Rack 2.2.21



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-eae2126736 advisory.

    Update to Rack 2.2.21

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4357 advisory.

    - -----------------------------------------------------------------------     Debian LTS Advisory DLA-4357-1              debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Utkarsh Gupta     November 01, 2025                           https://wiki.debian.org/LTS
    - -----------------------------------------------------------------------

    Package        : ruby-rack     Version        : 2.1.4-3+deb11u4     CVE ID         : CVE-2025-32441 CVE-2025-46727 CVE-2025-59830                      CVE-2025-61770 CVE-2025-61771 CVE-2025-61772                      CVE-2025-61780 CVE-2025-61919     Debian Bug     : 1104927 1116431 1117855 1117856 1117627 1117628

    Multiple vulnerabilities were found in ruby-rack, a modular Ruby     webserver interface, as follows:

      - CVE-2025-32441: Rack session can be restored after deletion.
      - CVE-2025-46727: Unbounded parameter parsing in Rack::QueryParser         can lead to memory exhaustion.
      - CVE-2025-59830: Unbounded parameter parsing in Rack::QueryParser         can lead to memory exhaustion via semicolon-separated parameters.
      - CVE-2025-61770: Unbounded multipart preamble buffering enables         DoS (memory exhaustion).
      - CVE-2025-61771: Multipart parser buffers large nonfile fields         entirely in memory, enabling DoS (memory exhaustion).
      - CVE-2025-61772: Multipart parser buffers unbounded per-part         headers, enabling DoS (memory exhaustion).
      - CVE-2025-61919: Unbounded read in Rack::Request form parsing can         lead to memory exhaustion.
      - CVE-2025-61780: Improper handling of headers in Rack::Sendfile         may allow proxy bypass.

    For Debian 11 bullseye, these problems have been fixed in version     2.1.4-3+deb11u4.

    We recommend that you upgrade your ruby-rack packages.

    For the detailed security status of ruby-rack please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ruby-rack

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Rack is a modular Ruby web server interface. Prior to version 2.2.14, when using the `Rack::Session::Pool`     middleware, simultaneous rack requests can restore a deleted rack session, which allows the     unauthenticated user to occupy that session. Rack session middleware prepares the session at the beginning     of request, then saves is back to the store with possible changes applied by host rack application. This     way the session becomes to be a subject of race conditions in general sense over concurrent rack requests.
    When using the `Rack::Session::Pool` middleware, and provided the attacker can acquire a session cookie     (already a major issue), the session may be restored if the attacker can trigger a long running request     (within that same session) adjacent to the user logging out, in order to retain illicit access even after     a user has attempted to logout. Version 2.2.14 contains a patch for the issue. Some other mitigations are     available. Either ensure the application invalidates sessions atomically by marking them as logged out     e.g., using a `logged_out` flag, instead of deleting them, and check this flag on every request to prevent     reuse; or implement a custom session store that tracks session invalidation timestamps and refuses to     accept session data if the session was invalidated after the request began. (CVE-2025-32441)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02564-1 advisory.

    - Update to version 2.23
    - CVE-2025-46727: Fixed Unbounded-Parameter DoS in Rack:QueryParser. (bsc#1242893)
    - CVE-2025-32441: Fixed a bug where simultaneous rack requests can restore a deleted rack session.
    (bsc#1242898)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02429-1 advisory.

    - Update to version 2.23
    - CVE-2025-46727: Fixed Unbounded-Parameter DoS in Rack:QueryParser. (bsc#1242893)
    - CVE-2025-32441: Fixed a bug where simultaneous rack requests can restore a deleted rack session.
    (bsc#1242898)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02329-1 advisory.

    - Update to version 2.23
    - CVE-2025-46727: Fixed Unbounded-Parameter DoS in Rack:QueryParser. (bsc#1242893)
    - CVE-2025-32441: Fixed a bug where simultaneous rack requests can restore a deleted rack session.
    (bsc#1242898)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02330-1 advisory.

    - Update to version 2.23
    - CVE-2025-46727: Fixed Unbounded-Parameter DoS in Rack:QueryParser. (bsc#1242893)
    - CVE-2025-32441: Fixed a bug where simultaneous rack requests can restore a deleted rack session.
    (bsc#1242898)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2025-203b7db566 advisory.

    https://fedoraproject.org/wiki/Changes/Ruby_on_Rails_8.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01586-2 advisory.

    - CVE-2025-46727: possible memory exhaustion due to unbounded parameter parsing in Rack::QueryParser     (bsc#1242894).
    - CVE-2025-32441: deleted sessions can be restored and occupied by unauthenticated users when the     Rack::Session::Pool       middleware is being used (bsc#1242899).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01586-1 advisory.

    - CVE-2025-46727: possible memory exhaustion due to unbounded parameter parsing in Rack::QueryParser     (bsc#1242894).
    - CVE-2025-32441: deleted sessions can be restored and occupied by unauthenticated users when the     Rack::Session::Pool       middleware is being used (bsc#1242899).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7507-1 advisory.

    It was discovered that Rack incorrectly handled deleted rack sessions. An attacker could possibly use this     issue to expose sensitive information or to gain unauthorized access to user accounts. (CVE-2025-32441)

    It was discovered that Rack incorrectly limited the number of parameters in a web request. An attacker     could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS,     Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04. (CVE-2025-46727)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
275257	Fedora 41 : rubygem-rack (2025-a35addbf9b)	Nessus	Fedora Local Security Checks	high
275253	Fedora 42 : rubygem-rack (2025-eae2126736)	Nessus	Fedora Local Security Checks	high
272174	Debian dla-4357 : ruby-rack - security update	Nessus	Debian Local Security Checks	medium
252898	Linux Distros Unpatched Vulnerability : CVE-2025-32441	Nessus	Misc.	medium
243264	SUSE SLES15 / openSUSE 15 Security Update : rmt-server (SUSE-SU-2025:02564-1)	Nessus	SuSE Local Security Checks	medium
242538	SUSE SLES15 Security Update : rmt-server (SUSE-SU-2025:02429-1)	Nessus	SuSE Local Security Checks	medium
242223	SUSE SLES15 Security Update : rmt-server (SUSE-SU-2025:02329-1)	Nessus	SuSE Local Security Checks	medium
242212	SUSE SLES15 Security Update : rmt-server (SUSE-SU-2025:02330-1)	Nessus	SuSE Local Security Checks	medium
242193	Fedora 43 : rubygem-actioncable / rubygem-actionmailbox / rubygem-actionmailer / etc (2025-203b7db566)	Nessus	Fedora Local Security Checks	medium
237782	SUSE SLES15 Security Update : rubygem-rack (SUSE-SU-2025:01586-2)	Nessus	SuSE Local Security Checks	medium
237086	SUSE SLES15 / openSUSE 15 Security Update : rubygem-rack (SUSE-SU-2025:01586-1)	Nessus	SuSE Local Security Checks	medium
236870	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 / 25.04 : Rack vulnerabilities (USN-7507-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2025-32441

medium

Tenable Plugins

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium