CVE-2025-46336: Rack session gets restored after deletion

The vulnerability described is a race condition in Rack::Session::Pool where a deleted session can be restored by a concurrent request. The provided patch (commit c28c4a8c1861d814e09f2ae48264ac4c40be2d3b) modifies two key methods: write_session and delete_session in lib/rack/session/pool.rb.

The core of the vulnerability lies in the write_session method. Before the patch, this method did not check if the session it was about to write still existed or was valid. If a session was deleted by one request, a concurrent, long-running request (which had loaded the session data before deletion) could subsequently call write_session and successfully write its stale data, thus restoring the deleted session. The patch fixes this by adding a crucial check: return false unless get_session_with_fallback(session_id). This line ensures that the session is still considered valid before any data is written to it.

Therefore, Rack::Session::Pool#write_session is identified as the vulnerable function because it contained the flaw (the missing check) that allowed the session restoration to occur. While the delete_session method was also modified to improve the robustness of session handling (by ensuring a new, empty session is stored when a session is renewed after deletion, rather than just generating a SID), the actual act of incorrectly restoring the session was performed by the write_session method in its vulnerable state.