Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-06-24T15:42:44 concurrent-ruby: Concurrent-ruby: Incorrect write lock granting leading to broken mutual exclusion 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N CWE-190

concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReentrantReadWriteLock can incorrectly grant a write lock after one thread acquires the read lock 32,768 times. The lock stores a thread's local read and write hold counts in one integer. The low 15 bits are used for the read hold count, and bit 15 is used as WRITE_LOCK_HELD. After 32,768 reentrant read acquisitions, the local read count crosses into the write-lock bit. try_write_lock then treats the thread as already holding a write lock and returns true without setting the global RUNNING_WRITER bit. This breaks the core mutual-exclusion guarantee: the caller is told it has a write lock, but other threads can still hold or acquire read locks at the same time. This vulnerability is fixed in 1.3.7.

A flaw was found in concurrent-ruby. The Concurrent::ReentrantReadWriteLock component can incorrectly grant a write lock to a thread while other threads still hold or can acquire read locks. This occurs when a thread acquires a read lock 32,768 times, causing an internal counter to incorrectly indicate a write lock is held. This breaks the fundamental mutual-exclusion guarantee of the lock, potentially leading to unexpected behavior or data corruption due to concurrent access.

Red Hat rates this flaw as Low impact, consistent with the upstream CVEORG assessment (2.0). The vulnerability requires a single thread to acquire the same ReentrantReadWriteLock read lock 32,768 times reentrantly before the internal counter overflows into the write-lock bit. This precondition does not arise in normal application usage. While concurrent-ruby ships the vulnerable lock class in Red Hat products, no transitive dependency was confirmed to instantiate ReentrantReadWriteLock. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp21/backend Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp21/system Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp21/zync Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp22/backend Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp22/system Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp22/zync Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp26/toolbox Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp2/backend-rhel8 Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp2/system-rhel7 Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp2/system-rhel8 Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp2/system-rhel9 Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp2/toolbox-rhel8 Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp2/toolbox-rhel9 Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp2/zync-rhel8 Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp2/zync-rhel9 Red Hat OpenStack Platform 17.1 Fix deferred rubygem-concurrent-ruby Red Hat Satellite 6 Fix deferred rubygem-concurrent-ruby Red Hat Satellite 6 Fix deferred satellite-capsule:el8/rubygem-concurrent-ruby https://www.cve.org/CVERecord?id=CVE-2026-54905 https://nvd.nist.gov/vuln/detail/CVE-2026-54905 https://github.com/ruby-concurrency/concurrent-ruby/security/advisories/GHSA-wv3x-4vxv-whpp