CVE-2026-54906 concurrent-ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruption
Attackers can corrupt lock state or cause denial of service by improperly releasing locks in the concurrent-ruby library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54906?
CVE-2026-54906 is a low-severity vulnerability in ruby-concurrency concurrent-ruby, published on 24 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReadWriteLock#release_write_lock does not verify that the calling thread acquired the write lock. Any thread with access to the lock object can release an active write lock held by another thread. A second writer can then enter its critical section while the first writer is still running. Concurrent::ReadWriteLock#release_read_lock also decrements the shared counter even when no read lock is held. Calling it on a fresh lock changes the counter from 0 to -1, after which normal read acquisition raises Concurrent::ResourceLimitError. This is a synchronization correctness issue in the public Concurrent::ReadWriteLock API. This vulnerability is fixed in 1.3.7.
Which versions are affected by CVE-2026-54906?
2 open source packages ship an affected version, including concurrent-ruby. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
concurrent-ruby RubyGems | All versions | 1.3.7 |
concurrent-ruby RubyGems | All versions | 1.3.7 |
Products include Rubyconcurrency Concurrent Ruby.
How do I fix CVE-2026-54906?
Upgrade concurrent-ruby to 1.3.7 or later.
Is CVE-2026-54906 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54906 exists.
Other vulnerabilities in ruby-concurrency concurrent-ruby
Sources
Also known as AZL-91287, CLEANSTART-2026-JE87878, CLEANSTART-2026-RJ92739, DEBIAN-CVE-2026-54906, GHSA-6wx8-w4f5-wwcr, MINI-29jf-g952-x29m and 18 more.