CVE-2026-54906: Rubyconcurrency Concurrent Ruby vulnerability (CVSS 9.8)

Description

concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReadWriteLock#release_write_lock does not verify that the calling thread acquired the write lock. Any thread with access to the lock object can release an active write lock held by another thread. A second writer can then enter its critical section while the first writer is still running. Concurrent::ReadWriteLock#release_read_lock also decrements the shared counter even when no read lock is held. Calling it on a fresh lock changes the counter from 0 to -1, after which normal read acquisition raises Concurrent::ResourceLimitError. This is a synchronization correctness issue in the public Concurrent::ReadWriteLock API. This vulnerability is fixed in 1.3.7.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Rubyconcurrency Concurrent Ruby< 1.3.7

Remediation

Fixed in

Rubyconcurrency Concurrent Ruby≥ 1.3.7

References

https://github.com/ruby-concurrency/concurrent-ruby/security/advisories/GHSA-6wx8-w4f5-wwcrThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-54906 being actively exploited?

CVE-2026-54906 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.25%.

How severe is CVE-2026-54906?

CVE-2026-54906 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 0.25% probability of exploitation.

Which products are affected by CVE-2026-54906?

Affected products include Rubyconcurrency Concurrent Ruby.

How do I fix CVE-2026-54906?

Upgrade affected software to a fixed version, for example Rubyconcurrency Concurrent Ruby 1.3.7 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-54906 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo