Are stateless sessions inherently unsafe? NVD and MITRE seem to think so

[whileloop123]

I recently noticed that large number of CVEs have been filed citing "improper session expiration". The crux of these disclosures are that a session must be invalidated on the server when a user logs out or changes their password. It is not enough to delete the cookie from the browser or to have an expiration set on the cookie. The CVEs all cite https://cwe.mitre.org/data/definitions/613.html as the basis of the disclosure, but this document makes no mention of session invalidation at all, only session expiration.

So what's going here? Are stateless sessions unsafe for use since it is not possible to invalidate them or is this a case of the CVE system simply not working as intended?

Heres a list of a few examples: https://nvd.nist.gov/vuln/detail/CVE-2019-5638 https://nvd.nist.gov/vuln/detail/CVE-2020-6363 https://nvd.nist.gov/vuln/detail/CVE-2019-7215 https://nvd.nist.gov/vuln/detail/CVE-2020-4253 https://nvd.nist.gov/vuln/detail/CVE-2023-40732 https://nvd.nist.gov/vuln/detail/CVE-2020-6292

[compressedgas]

Yes, if the server does not remember what sessions have been opened. It is not possible for the server to close them early by rejecting the cookie for a session before it has expired.