CVE-2026-54906

Name of the Vulnerable Software and Affected Versions concurrent-ruby versions prior to 1.3.7

Description A synchronization correctness issue exists in the public Concurrent::ReadWriteLock API. The function release write lock() does not verify if the calling thread actually acquired the write lock, allowing any thread with access to the lock object to release a write lock held by another thread. This can lead to a situation where a second writer enters its critical section while the first writer is still active, breaking mutual exclusion and potentially causing data races.

Additionally, the function release read lock() decrements the shared counter even when no read lock is held. If called on a fresh lock, the counter changes from 0 to -1, which causes subsequent read acquisitions to fail by raising a Concurrent::ResourceLimitError (an error indicating that the system has reached its limit for reader threads), effectively resulting in a denial of service for that lock.

Recommendations Update to version 1.3.7. As a temporary workaround, restrict the use of the manual release write lock() and release read lock() functions to ensure they are only called by the threads that acquired the respective locks.