CVE-2026-54905: concurrent-ruby: `ReentrantReadWriteLock` read-count overflow grants a write lock without exclusivity

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-24 · updated 2026-10-25
Weakness: CWE-128

Description

concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReentrantReadWriteLock can incorrectly grant a write lock after one thread acquires the read lock 32,768 times. The lock stores a thread's local read and write hold counts in one integer. The low 15 bits are used for the read hold count, and bit 15 is used as WRITE_LOCK_HELD. After 32,768 reentrant read acquisitions, the local read count crosses into the write-lock bit. try_write_lock then treats the thread as already holding a write lock and returns true without setting the global RUNNING_WRITER bit. This breaks the core mutual-exclusion guarantee: the caller is told it has a write lock, but other threads can still hold or acquire read locks at the same time. This vulnerability is fixed in 1.3.7.

Affected products

ruby-concurrency concurrent-ruby: before 1.3.7 — fixed in 1.3.7
Rubygems Concurrent-Ruby: before 1.3.7; 0.0.1, 0.1.0, 0.1.1, 0.1.1.pre.1, 0.1.1.pre.2, 0.1.1.pre.3 (+71) — fixed in 1.3.7

How to fix

Upgrade to a fixed version: ruby-concurrency concurrent-ruby 1.3.7; Rubygems Concurrent-Ruby 1.3.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-54905 or the next vulnerability affects your stack