CVE-2026-54906 Details

A synchronization correctness vulnerability has been identified in the `concurrent-ruby` library, specifically in the `Concurrent::ReadWriteLock` component, prior to version 1.3.7. The issue arises because the `release_write_lock` method does not verify if the calling thread actually holds the write lock. This flaw allows any thread with access to the lock object to release a write lock held by another thread, potentially leading to concurrent execution of critical sections by multiple writers. Additionally, the `release_read_lock` method improperly decrements the lock's shared counter even when no read lock is held, causing a fresh lock to register a counter of -1. This stray read release can disrupt normal lock operations and trigger a `Concurrent::ResourceLimitError` during subsequent read acquisitions.

Users should upgrade to `concurrent-ruby` version 1.3.7 or later, where this vulnerability has been fixed.