Rubyconcurrency Concurrent Ruby — CVE-2026-54906 (Critical)

Summary

concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReadWriteLock#release_write_lock does not verify that the calling thread acquired the write lock. Any thread with access to the lock object can release an active write lock held by another thread. A second writer can then enter its critical section while the first writer is still running. Concurrent::ReadWriteLock#release_read_lock also decrements the shared counter even when no read lock is held. Calling it on a fresh lock changes the counter from 0 to -1, after which normal read acquisition raises Concurrent:

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 9.8) in Rubyconcurrency Concurrent Ruby. Patch or mitigate promptly. EPSS percentile: 0%.

Operator check

Review CVE-2026-54906 in your asset inventory. Apply patches per vendor guidance and verify Concurrent Ruby is not exposed. CVSS score: 9.8. EPSS probability: 0.1%; percentile: 0%.

Sources