ruby-concurrency concurrent-ruby up to 1.3.6 ReadWriteLock#release_write_lock lock check

Summaryinfo

A vulnerability categorized as problematic has been discovered in ruby-concurrency concurrent-ruby up to 1.3.6. Impacted is the function Concurrent::ReadWriteLock#release_write_lock. The manipulation results in lock check. This vulnerability is known as CVE-2026-54906. Attacking locally is a requirement. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in ruby-concurrency concurrent-ruby up to 1.3.6. It has been classified as problematic. Affected is the function Concurrent::ReadWriteLock#release_write_lock. The manipulation with an unknown input leads to a lock check vulnerability. CWE is classifying the issue as CWE-414. A product does not check to see if a lock is present before performing sensitive operations on a resource. This is going to have an impact on integrity, and availability. CVE summarizes:

concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReadWriteLock#release_write_lock does not verify that the calling thread acquired the write lock. Any thread with access to the lock object can release an active write lock held by another thread. A second writer can then enter its critical section while the first writer is still running. Concurrent::ReadWriteLock#release_read_lock also decrements the shared counter even when no read lock is held. Calling it on a fresh lock changes the counter from 0 to -1, after which normal read acquisition raises Concurrent::ResourceLimitError. This is a synchronization correctness issue in the public Concurrent::ReadWriteLock API. This vulnerability is fixed in 1.3.7.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-54906 since 06/16/2026. The exploitability is told to be difficult. Local access is required to approach this attack. Technical details are known, but there is no available exploit.

Upgrading to version 1.3.7 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Programming Language Software

Vendor

• ruby-concurrency

Name

• concurrent-ruby

Version

• 1.3.0
• 1.3.1
• 1.3.2
• 1.3.3
• 1.3.4
• 1.3.5
• 1.3.6

Website

• Product: https://github.com/ruby-concurrency/concurrent-ruby/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion