By vendor

Rubyconcurrency vulnerabilities

Known CVEs affecting Rubyconcurrency products, prioritized by severity, with SEC.co remediation and detection guidance.

2 published vulnerabilities

• CVE-2026-54904HIGH 7.5

  concurrent-ruby, a popular Ruby concurrency library, contains a critical flaw in its AtomicReference#update method. When an AtomicReference contains the special floating-point value NaN (Not-a-Number), calling update() causes the application to enter an infinite retry loop. This happens because NaN has a unique mathematical property: NaN never equals itself, even when compared to itself. The update method keeps retrying indefinitely, consuming CPU resources and potentially freezing requests or background jobs. This affects applications that store numeric data derived from external sources in AtomicReferences and then attempt to update them.

• CVE-2026-54905MEDIUM 5.5

  A flaw in concurrent-ruby's ReentrantReadWriteLock allows a thread to incorrectly obtain a write lock after repeatedly acquiring a read lock 32,768 times. The lock mechanism uses a single integer to track hold counts, and this specific reentry threshold causes the read count to overflow into a bit flag reserved for write locks. As a result, a thread can be granted write lock status without the library actually preventing other threads from holding read locks simultaneously, breaking the mutual exclusion guarantee that write locks are supposed to provide. This creates a race condition where concurrent read and write access can occur unsafely.