Cyber Resilience

CVE-2026-54906

Rubyconcurrency Concurrent Ruby ≤ 1.3.7

Published
24 June 2026
Modified
26 June 2026
CVSS Score v4 2.1
Click a component to see what it means
Raw vectorCVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0016 6th percentile
Risk Priority 18 floored blend · peak EPSS

Summary

CVE-2026-54906 is a low-severity Missing Lock Check (CWE-414) vulnerability in Rubyconcurrency Concurrent Ruby. Its CVSS base score is 2.1 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReadWriteLock#release_write_lock does not verify that the calling thread acquired the write lock. Any thread with access to the lock object can release an active write lock held by another…

more

thread. A second writer can then enter its critical section while the first writer is still running. Concurrent::ReadWriteLock#release_read_lock also decrements the shared counter even when no read lock is held. Calling it on a fresh lock changes the counter from 0 to -1, after which normal read acquisition raises Concurrent::ResourceLimitError. This is a synchronization correctness issue in the public Concurrent::ReadWriteLock API. This vulnerability is fixed in 1.3.7.

CWE(s)
CWE-414CWE-667

Related Threats

MITRE ATT&CK Enterprise Techniques

T1499 Endpoint Denial of Service Impact
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1548 Abuse Elevation Control Mechanism Privilege Escalation
Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-54904Same product: Rubyconcurrency Concurrent Ruby
CVE-2026-54905Same product: Rubyconcurrency Concurrent Ruby
CVE-2023-53013Shared CWE-667
CVE-2024-40969Shared CWE-667
CVE-2024-43863Shared CWE-667
CVE-2025-39885Shared CWE-667
CVE-2025-38373Shared CWE-667
CVE-2026-43029Shared CWE-667
CVE-2024-56743Shared CWE-667
CVE-2023-52595Shared CWE-667

Affected Assets

rubyconcurrency
concurrent ruby
≤ 1.3.7

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prevent missing lock checks via code review, static analysis, and concurrency testing.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect race conditions caused by missing locks but does not prevent them by itself.

A.8.25 Secure development life cycle partial match
prevents

Secure SDLC practices include concurrency and synchronization reviews that catch missing lock checks.

A.8.26 Application security requirements partial match
prevents

Application security requirements can mandate proper lock acquisition/release patterns.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles address thread-safety and resource synchronization.

A.8.28 Secure coding partial match
prevents

Secure coding standards require explicit lock acquisition checks before operating on shared resources.

A.8.32 Change management partial match
prevents

Change management may catch locking issues introduced by modifications but does not prevent the weakness itself.

References