CVE-2026-54906

concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReadWriteLock#release_write_lock does not verify that the calling thread acquired the write lock. Any thread with access to the lock object can release an active write lock held by another thread. A second writer can then enter its critical section while the first writer is still running. Concurrent::ReadWriteLock#release_read_lock also decrements the shared counter even when no read lock is held. Calling it on a fresh lock changes the counter from 0 to -1, after which normal read acquisition raises Concurrent::ResourceLimitError. This is a synchronization correctness issue in the public Concurrent::ReadWriteLock API. This vulnerability is fixed in 1.3.7.

• CWE-414
• CWE-667

• https://github.com/ruby-concurrency/concurrent-ruby/security/advisories/GHSA-6wx8-w4f5-wwcrThird Party Advisory
• https://github.com/ruby-concurrency/concurrent-ruby/security/advisories/GHSA-6wx8-w4f5-wwcrThird Party Advisory

Published

Jun 24, 2026

Last Modified

Jun 26, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54900Oj (Optimized JSON) is a JSON parser and Object marshaller p…6.3
• CVE-2026-54901Oj (Optimized JSON) is a JSON parser and Object marshaller p…6.3
• CVE-2026-54902Oj (Optimized JSON) is a JSON parser and Object marshaller p…6.3
• CVE-2026-54903Oj (Optimized JSON) is a JSON parser and Object marshaller p…6.3
• CVE-2026-54904concurrent-ruby is a modern concurrency tools for Ruby. Prio…7.5
• CVE-2026-54905concurrent-ruby is a modern concurrency tools for Ruby. Prio…5.5
• CVE-2026-54908Pion DTLS is a Go implementation of Datagram Transport Layer…6.3
• CVE-2026-54909pion/stun is a Go implementation of STUN. Prior to 3.1.3, XO…5.3
• CVE-2026-5491DriveLock Directory Traversal Information Disclosure Vulnera…7.5
• CVE-2026-54910FileBrowser Quantum is a free, self-hosted, web-based file m…7.7
• CVE-2026-54911UltraJSON is a fast JSON encoder and decoder written in pure…6.5
• CVE-2026-54917SeaweedFS is a distributed storage system for object storage…10