CVE-2026-54906
Description
A flaw was found in concurrent-ruby, a Ruby library for managing concurrent operations. The Concurrent::ReadWriteLock component contains a synchronization issue where write locks can be released by unauthorized threads. This could allow multiple threads to write concurrently, potentially leading to data corruption. Furthermore, an issue with read lock management can cause a denial of service (DoS) by preventing legitimate read operations.
Statement
This is essentially a library misuse scenario. The attack requires local code execution in the same Ruby process AND use of the manual locking API (ReadWriteLock). Most applications use Concurrent::Future, Concurrent::Promise, Concurrent::Promises, Concurrent::Array/Hash, and Concurrent::Atom — not the low-level ReadWriteLock.
This is a synchronization correctness issue in the public Concurrent::ReadWriteLock API. It should not be framed as an authorization bypass; the lock is an in-process concurrency primitive, not an access-control boundary. The bug requires an attacker to execute code that has access to the same Concurrent::ReadWriteLock object. It is an in-process API misuse issue, not a remotely reachable vulnerability.
Mitigation
The concurrent-ruby package ships `Concurrent::ReadWriteLock`, which contains a synchronization flaw allowing concurrent readers and writers under high-contention workloads.
Updating to concurrent-ruby version 1.3.5 or later resolves this issue.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.6 | 9.8 | N/A |
| Attack Vector | Local | Network | N/A |
| Attack Complexity | High | Low | N/A |
| Privileges Required | Low | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | High | N/A |
| Integrity Impact | Low | High | N/A |
| Availability Impact | Low | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
Rationale about the difference between NVD and RH CVSS:
- AV:N → AV:L —
concurrent-rubyis an in-process Ruby library, and theReadWriteLocksynchronization flaw is only exploitable by code executing within the same Ruby process that has access to the affected lock instance. It is not directly reachable over the network. - AC:L → AC:H — Successful exploitation depends on a specific concurrent execution state: another thread must already hold the affected lock, and the attacker must invoke the release operation while that lock is active. These timing and environmental conditions increase the attack complexity beyond a straightforward API call.
- C:H → C:N — No confidentiality impact. The vulnerability affects synchronization semantics only and does not expose or disclose protected information.
- I:H → I:L — The flaw can violate mutual exclusion, resulting in race conditions, stale reads, lost updates, or corruption of application-managed shared state within the affected critical section. However, its impact is limited to the application's synchronization logic and does not enable arbitrary modification of system resources or a broader integrity compromise.
- A:H → A:L — The vulnerability can disrupt normal application behavior by corrupting lock state or triggering synchronization failures, but it does not inherently cause a persistent denial of service or complete loss of availability of the affected component. Its availability impact is therefore limited.
Understanding the Weakness (CWE)
Integrity,Confidentiality,Other
Technical Impact: Modify Application Data; Read Application Data; Alter Execution Logic
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
