CVE-2026-54905 concurrent-ruby: `ReentrantReadWriteLock` read-count overflow grants a write lock without exclusivity
An integer overflow in concurrent-ruby allows a thread to bypass write lock exclusivity, potentially leading to data corruption or race conditions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54905?
CVE-2026-54905 is a low-severity vulnerability in ruby-concurrency concurrent-ruby, published on 24 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReentrantReadWriteLock can incorrectly grant a write lock after one thread acquires the read lock 32,768 times. The lock stores a thread's local read and write hold counts in one integer. The low 15 bits are used for the read hold count, and bit 15 is used as WRITE_LOCK_HELD. After 32,768 reentrant read acquisitions, the local read count crosses into the write-lock bit. try_write_lock then treats the thread as already holding a write lock and returns true without setting the global RUNNING_WRITER bit. This breaks the core mutual-exclusion guarantee: the caller is told it has a write lock, but other threads can still hold or acquire read locks at the same time. This vulnerability is fixed in 1.3.7.
Weakness: CWE-128
Which versions are affected by CVE-2026-54905?
2 open source packages ship an affected version, including concurrent-ruby. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
concurrent-ruby RubyGems | All versions | 1.3.7 |
concurrent-ruby RubyGems | All versions | 1.3.7 |
Products include Rubyconcurrency Concurrent Ruby.
How do I fix CVE-2026-54905?
Upgrade concurrent-ruby to 1.3.7 or later.
Is CVE-2026-54905 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54905 exists.
Other vulnerabilities in ruby-concurrency concurrent-ruby
Sources
Also known as AZL-91290, CLEANSTART-2026-CH23308, CLEANSTART-2026-VX25818, DEBIAN-CVE-2026-54905, GHSA-wv3x-4vxv-whpp, MINI-485g-xhv3-g79h and 18 more.