AIKIDO-2025-10341

TL;DR

Affected versions of this package are vulnerable to a race condition in the @sse_clients hash management within RackTransport, occurring when running in multi-threaded environments. This thread-unsafe implementation allows attackers to trigger denial-of-service (DoS) crashes by spamming SSE connections/disconnections, exploiting the error handling when concurrent threads attempt to modify the client registry during iteration. Additionally, the lack of synchronization around client IO streams creates a potential for data corruption if an attacker precisely times writes during stream modifications.