Mittel 4.2Linux-Server
CVE-2026-126076
actionpack: actionpack: Session retention across logout via race condition in CacheStore
actionpack
### Impact `ActionDispatch::Session::CacheStore` writes a session back to the cache at the end of each request that loaded it, without checking that the session's cache entry still exists. When a concurrent request destroys the session, through `reset_session` on logout or by deleting its cache entry on the server, a request that loaded the session earlier and finishes later restores it under its original session ID. Logout and server-side revocation could therefore fail to…
10. Nov 2026
Original bei Red Hat öffnen