ruby-concurrency concurrent-ruby up to 1.3.6 ReentrantReadWriteLock wrap-around

Summaryinfo

A vulnerability labeled as problematic has been found in ruby-concurrency concurrent-ruby up to 1.3.6. The impacted element is the function Concurrent::ReentrantReadWriteLock. Such manipulation leads to wrap-around. This vulnerability is uniquely identified as CVE-2026-54905. Local access is required to approach this attack. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in ruby-concurrency concurrent-ruby up to 1.3.6. It has been rated as problematic. Affected by this issue is the function Concurrent::ReentrantReadWriteLock. The manipulation with an unknown input leads to a wrap-around vulnerability. Using CWE to declare the problem leads to CWE-128. Wrap around errors occur whenever a value is incremented past the maximum value for its type and therefore "wraps around" to a very small, negative, or undefined value. Impacted is confidentiality, integrity, and availability. CVE summarizes:

concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReentrantReadWriteLock can incorrectly grant a write lock after one thread acquires the read lock 32,768 times. The lock stores a thread's local read and write hold counts in one integer. The low 15 bits are used for the read hold count, and bit 15 is used as WRITE_LOCK_HELD. After 32,768 reentrant read acquisitions, the local read count crosses into the write-lock bit. try_write_lock then treats the thread as already holding a write lock and returns true without setting the global RUNNING_WRITER bit. This breaks the core mutual-exclusion guarantee: the caller is told it has a write lock, but other threads can still hold or acquire read locks at the same time. This vulnerability is fixed in 1.3.7.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-54905 since 06/16/2026. The exploitation is known to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available.

Upgrading to version 1.3.7 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• ruby-concurrency

Name

• concurrent-ruby

Version

• 1.3.0
• 1.3.1
• 1.3.2
• 1.3.3
• 1.3.4
• 1.3.5
• 1.3.6

Website

• Product: https://github.com/ruby-concurrency/concurrent-ruby/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion