https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T02:58:20.199738+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2019-25025 CVE-2019-25025 2026-10-07T02:58:20.252700+00:00

The activerecord-session_store (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a correct guess in a relatively short amount of time. This is a related issue to CVE-2019-16782.

 https://cve.radiocsirt.org/vuln/ghsa-cvw2-xj8r-mjf7 GHSA-cvw2-xj8r-mjf7 — Activerecord-session_store Vulnerable to Timing Attack 2026-10-07T02:58:20.252787+00:00

Affected: RubyGems: activerecord-session_store

The `activerecord-session_store` (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a correct guess in a relatively short amount of time. This is a related issue to CVE-2019-16782.

## Recommendation

This has been fixed in version 2.0.0. All users are advised to update to this version or later.