CVE-2026-54904

Name of the Vulnerable Software and Affected Versions concurrent-ruby versions prior to 1.3.7

Description The Concurrent::AtomicReference#update function can enter a permanent busy retry loop when the current value is Float::NAN. This occurs due to the interaction between AtomicReference#update, which retries until compare and set(old value, new value) succeeds, and the numeric compare and set function, which checks if old == old value before attempting an atomic swap. Because Ruby NaN (Not a Number) semantics dictate that Float::NAN == Float::NAN is always false, the comparison fails every time, causing the function to repeatedly evaluate the caller's block without returning. In services storing externally derived numeric values in an AtomicReference, this can lead to CPU exhaustion or permanent request and job hangs.

Recommendations Update to version 1.3.7.