How severe is CVE-2026-54906?

CVE-2026-54906 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2026-54906 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (6th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-54906?

CVE-2026-54906 affects Rubyconcurrency Concurrent Ruby. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-54906?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2026-54906 have an EU (EUVD) identifier?

Yes. CVE-2026-54906 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-38811.

When was CVE-2026-54906 published?

CVE-2026-54906 was published on 2026-06-24 and last updated on 2026-06-26.

CVE-2026-54906

CVE-2026-54906 is a critical-severity vulnerability in Rubyconcurrency Concurrent Ruby with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-414.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v4: 2.1
EPSS exploit prediction: 0% (6th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-38811
Weakness: CWE-414
Affected product: Rubyconcurrency Concurrent Ruby
Published: 2026-06-24
Last modified: 2026-06-26

Description

concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReadWriteLock#release_write_lock does not verify that the calling thread acquired the write lock. Any thread with access to the lock object can release an active write lock held by another thread. A second writer can then enter its critical section while the first writer is still running. Concurrent::ReadWriteLock#release_read_lock also decrements the shared counter even when no read lock is held. Calling it on a fresh lock changes the counter from 0 to -1, after which normal read acquisition raises Concurrent::ResourceLimitError. This is a synchronization correctness issue in the public Concurrent::ReadWriteLock API. This vulnerability is fixed in 1.3.7.

Frequently asked questions

What is CVE-2026-54906?: concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReadWriteLock#release_write_lock does not verify that the calling thread acquired the write lock. Any thread with access to the lock object can release an active write lock held by another thread. A second writer can then enter its critical section while the first writer is still running. Concurrent::ReadWriteLock#release_read_lock also decrements the shared counter even when no read lock is held. Calling it on a fresh lock changes the counter from 0 to -1, after which normal read acquisition raises Concurrent::ResourceLimitError. This is a synchronization correctness issue in the public Concurrent::ReadWriteLock API. This vulnerability is fixed in 1.3.7.
How severe is CVE-2026-54906?: CVE-2026-54906 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2026-54906 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (6th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-54906?: CVE-2026-54906 affects Rubyconcurrency Concurrent Ruby. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-54906?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2026-54906 have an EU (EUVD) identifier?: Yes. CVE-2026-54906 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-38811.
When was CVE-2026-54906 published?: CVE-2026-54906 was published on 2026-06-24 and last updated on 2026-06-26.

References

https://github.com/ruby-concurrency/concurrent-ruby/security/advisories/GHSA-6wx8-w4f5-wwcr

Affected products (1)

cpe:2.3:a:rubyconcurrency:concurrent_ruby:*:*:*:*:*:ruby:*:*

More vulnerabilities in Rubyconcurrency Concurrent Ruby

CVE-2026-54904 — High (CVSS 7.5): concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::AtomicReference#update can enter a…
CVE-2026-54905 — Medium (CVSS 5.5): concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReentrantReadWriteLock can…

All CVEs affecting Rubyconcurrency Concurrent Ruby →

Other CWE-414 vulnerabilities

CVE-2025-54625 — Medium (CVSS 6.7): Race condition vulnerability in the kernel file system module. Impact: Successful exploitation of this vulnerability…
CVE-2025-54510 — Medium (CVSS 5.9): A missing lock verification in AMD Secure Processor (ASP) firmware may permit a locally authenticated attacker with…
CVE-2023-5447 — Medium (CVSS 5.5): Missing lock check in SynHsaService may create a use-after-free condition which causes abnormal termination of the…

Browse all CWE-414 vulnerabilities →