CVE-2026-54906
concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReadWriteLock#release_write_lock does not verify that the calling thread acquired the write lock. Any thread with access to the lock object can release an active write lock held by another thread. A second writer can then enter its critical section while the first writer is still running. Concurrent::ReadWriteLock#release_read_lock also decrements the shared counter even when no read lock is held. Calling it on a fresh lock changes the counter from 0 to -1, after which normal read acquisition raises Concurrent::ResourceLimitError. This is a synchronization correctness issue in the public Concurrent::ReadWriteLock API. This vulnerability is fixed in 1.3.7.
Scoring
- Severity
- LOW
- CVSS base score
- 2.1
- CVSS vector
- CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
- EPSS probability
- 0.25%
- CWE
- CWE-667, CWE-414
- Published
- 2026-06-24
- Last modified
- 2026-06-24
Affected products
- ruby-concurrency concurrent-ruby
Weakness type
Related vulnerabilities
- CVE-2026-80126 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-45404 — OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access
- CVE-2026-24182 — NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker could leak...
- CVE-2026-20065 — Multiple Cisco Products Snort 3 TBD Denial of Service Vulnerability
- CVE-2026-20757 — Improper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows a privileged...
- CVE-2026-21914 — Junos OS: SRX Series: A specifically malformed GTP message will cause an FPC crash
- CVE-2025-68657 — espressif/usb_host_hid Double-Free Race Condition in USB Host HID Device Close Path
- CVE-2025-34467 — ZwiiCMS < 13.7.00 Lock Persistence Authenticated DoS Against Administrative Pages