diff --git a/core/src/main/java/io/undertow/server/session/InMemorySessionManager.java b/core/src/main/java/io/undertow/server/session/InMemorySessionManager.java
index <HASH>..<HASH> 100644
--- a/core/src/main/java/io/undertow/server/session/InMemorySessionManager.java
+++ b/core/src/main/java/io/undertow/server/session/InMemorySessionManager.java
@@ -115,8 +115,11 @@ public class InMemorySessionManager implements SessionManager {
             throw UndertowMessages.MESSAGES.couldNotFindSessionCookieConfig();
         }
         String sessionID = config.findSessionId(serverExchange);
-        if(sessionID == null) {
+        while (sessionID == null) {
             sessionID = sessionIdGenerator.createSessionId();
+            if(sessions.containsKey(sessionID)) {
+                sessionID = null;
+            }
         }
         Object evictionToken;
         if (evictionQueue != null) {
Guard against session ID conflicts

The chances of this happening should be quite small, but add an explicit check anyway