CVE-2026-54905 Details
Description
concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReentrantReadWriteLock can incorrectly grant a write lock after one thread acquires the read lock 32,768 times. The lock stores a thread's local read and write hold counts in one integer. The low 15 bits are used for the read hold count, and bit 15 is used as WRITE_LOCK_HELD. After 32,768 reentrant read acquisitions, the local read count crosses into the write-lock bit. try_write_lock then treats the thread as already holding a write lock and returns true without setting the global RUNNING_WRITER bit. This breaks the core mutual-exclusion guarantee: the caller is told it has a write lock, but other threads can still hold or acquire read locks at the same time. This vulnerability is fixed in 1.3.7.
A vulnerability in the concurrent-ruby gem, specifically in the ReentrantReadWriteLock component, allows a thread to incorrectly receive a write lock after acquiring a read lock 32,768 times. This issue arises because the lock's tracking of read and write counts is stored in a single integer, with the lower 15 bits representing the read count and bit 15 indicating a write lock. Once a thread exceeds 32,768 read acquisitions, the count spills into the write-lock bit. Consequently, the try_write_lock method mistakenly assumes the thread already holds a write lock, returning true without activating the global RUNNING_WRITER bit. This flaw disrupts the fundamental mutual-exclusion principle, as the caller believes it has exclusive write access while other threads can still hold or acquire read locks.
Users can upgrade to concurrent-ruby version 1.3.7, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ruby-concurrency/concurrent-ruby/security/advisories/GHSA-wv3x-4vxv-whpp | CISA-ADP | Third Party Advisory |
| https://github.com/ruby-concurrency/concurrent-ruby/security/advisories/GHSA-wv3x-4vxv-whpp | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-128 | Wrap-around Error | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| rubyconcurrency concurrent ruby | < 1.3.7 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 24, 2026 | New CVE Received | [email protected] |
| Jun 24, 2026 | CVE Modified | CISA-ADP |