CVE-2026-54904 concurrent-ruby: `AtomicReference#update` livelocks when the stored value is `Float::NAN`
Attackers can cause CPU exhaustion or service hangs in Ruby applications using concurrent-ruby by triggering a livelock in AtomicReference updates with NaN values.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54904?
CVE-2026-54904 is a high-severity denial of service vulnerability in ruby-concurrency concurrent-ruby, published on 24 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::AtomicReference#update can enter a permanent busy retry loop when the current value is Float::NAN. The issue is caused by the interaction between AtomicReference#update, which retries until compare_and_set(old_value, new_value) succeeds; Numeric compare_and_set, which checks old == old_value before attempting the underlying atomic swap.; and Ruby NaN semantics, where Float::NAN == Float::NAN is always false. As a result, once an AtomicReference contains Float::NAN, calling #update repeatedly evaluates the caller's block and never returns. In services that store externally derived numeric values in an AtomicReference, this can cause CPU exhaustion or permanent request/job hangs. This vulnerability is fixed in 1.3.7.
Weakness: CWE-835
Which versions are affected by CVE-2026-54904?
2 open source packages ship an affected version, including concurrent-ruby. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
concurrent-ruby RubyGems | All versions | 1.3.7 |
concurrent-ruby RubyGems | All versions | 1.3.7 |
Products include Rubyconcurrency Concurrent Ruby.
How do I fix CVE-2026-54904?
Upgrade concurrent-ruby to 1.3.7 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-54904 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54904 exists.
Other vulnerabilities in ruby-concurrency concurrent-ruby
Sources
Also known as CLEANSTART-2026-UD48034, CLEANSTART-2026-YZ65956, DEBIAN-CVE-2026-54904, GHSA-h8w8-99g7-qmvj, MINI-2cf6-2h4p-gqcj, MINI-2rf9-4vf9-2xm5 and 23 more.