concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReadWriteLock#release_write_lock does not verify that the calling thread acquired the write lock. Any thread with access to the lock object can release an active write lock held by another thread. A second writer can then enter its critical section while the first writer is still running. Concurrent::ReadWriteLock#release_read_lock also decrements the shared counter even when no read lock is held. Calling it on a fresh lock changes the counter from 0 to -1, after which normal read acquisition raises Concurrent::ResourceLimitError. This is a synchronization correctness issue in the public Concurrent::ReadWriteLock API. This vulnerability is fixed in 1.3.7.
References
| Link | Resource |
|---|---|
| https://github.com/ruby-concurrency/concurrent-ruby/security/advisories/GHSA-6wx8-w4f5-wwcr | Third Party Advisory |
| https://github.com/ruby-concurrency/concurrent-ruby/security/advisories/GHSA-6wx8-w4f5-wwcr | Third Party Advisory |
Configurations
History
26 Jun 2026, 20:00
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:rubyconcurrency:concurrent_ruby:*:*:*:*:*:ruby:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| References | () https://github.com/ruby-concurrency/concurrent-ruby/security/advisories/GHSA-6wx8-w4f5-wwcr - Third Party Advisory | |
| First Time |
Rubyconcurrency
Rubyconcurrency concurrent Ruby |
24 Jun 2026, 19:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/ruby-concurrency/concurrent-ruby/security/advisories/GHSA-6wx8-w4f5-wwcr - |
24 Jun 2026, 17:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-24 17:17
Updated : 2026-06-26 20:00
NVD link : CVE-2026-54906
Mitre link : CVE-2026-54906
CVE.ORG link : CVE-2026-54906
JSON object : View
Products Affected
rubyconcurrency
- concurrent_ruby