critical
CVE-2026-54906
concurrent-ruby: rubygem-concurrent-ruby: concurrent-ruby: Synchronization flaw in ReadWriteLock allows unauthorized lock release and denial of service
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA2.1CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Red Hat3.6CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Trivy's own label is CRITICAL. Rated critical by NVD, Photon OS. Rated lower by GHSA (low), Red Hat (low), Azure Linux (low).
Description
concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReadWriteLock#release_write_lock does not verify that the calling thread acquired the write lock. Any thread with access to the lock object can release an active write lock held by another thread. A second writer can then enter its critical section while the first writer is still running. Concurrent::ReadWriteLock#release_read_lock also decrements the shared counter even when no read lock is held. Calling it on a fresh lock changes the counter from 0 to -1, after which normal read acquisition raises Concurrent::ResourceLimitError. This is a synchronization correctness issue in the public Concurrent::ReadWriteLock API. This vulnerability is fixed in 1.3.7.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| Photon OS 4.0 | rubygem-concurrent-ruby | 1.1.7-2.ph4 |
| Photon OS 5.0 | rubygem-concurrent-ruby | 1.3.7-1.ph5 |
| Azure Linux 3.0 | rubygem-concurrent-ruby | 0:1.3.7-1.azl3 |
| chainguard | cinc-auditor, commercial-gitlab-rails-ee-19.2, commercial-gitlab-rails-ee-fips-19.2 and 31 more | 7.1.7-r7 and 22 more |
| debian 11 | ruby-concurrent | no fix listed |
| debian 12 | ruby-concurrent | no fix listed |
| debian 13 | ruby-concurrent | no fix listed |
| debian 14 | ruby-concurrent | 1.3.7-1 |
| echo | ruby-concurrent | no fix listed |
| minimos | logstash-8.19, logstash-9.4, logstash-9.5 and 5 more | 8.19.21-r0 and 4 more |
| rapidfort debian 12 | ruby-concurrent | 0:1.3.7-1 |
| rapidfort debian 13 | ruby-concurrent | 0:1.3.7-1 |
Show all 64 entries from 15 sources
| Source | Package | Fixed in |
|---|---|---|
| Photon OS 4.0 | rubygem-concurrent-ruby | 1.1.7-2.ph4 |
| Photon OS 5.0 | rubygem-concurrent-ruby | 1.3.7-1.ph5 |
| Azure Linux 3.0 | rubygem-concurrent-ruby | 0:1.3.7-1.azl3 |
| chainguard | cinc-auditor | 7.1.7-r7 |
| chainguard | commercial-gitlab-rails-ee-19.2 | 19.2.7-r4 |
| chainguard | commercial-gitlab-rails-ee-fips-19.2 | 19.2.7-r4 |
| chainguard | kube-fluentd-operator | 1.18.2-r71 |
| chainguard | kube-logging-operator | 6.7.0-r5 |
| chainguard | logstash-8.19 | 8.19.21-r0 |
| chainguard | logstash-9.4 | 9.4.6-r0 |
| chainguard | logstash-9.5 | 9.5.2-r0 |
| chainguard | logstash-fips-9.4 | 9.4.6-r0 |
| chainguard | logstash-fips-9.5 | 9.5.2-r0 |
| chainguard | ruby3.2-fluentd-kubernetes-daemonset-1.16 | 1.16.11.1.0-r4 |
| chainguard | ruby3.2-fluentd-kubernetes-daemonset-1.17 | 1.17.1.1.2-r11 |
| chainguard | ruby3.2-fluentd-kubernetes-daemonset-1.18 | 1.18.0.1.5-r4 |
| chainguard | ruby3.2-fluentd-kubernetes-daemonset-1.19 | 1.19.2.1.1-r5 |
| chainguard | ruby3.2-rails-7.2 | 7.2.3.1-r4 |
| chainguard | ruby3.2-rails-8.0 | 8.0.5-r3 |
| chainguard | ruby3.2-rails-8.1 | 8.1.3-r6 |
| chainguard | ruby3.3-fluentd-kubernetes-daemonset-1.16 | 1.16.11.1.0-r4 |
| chainguard | ruby3.3-fluentd-kubernetes-daemonset-1.17 | 1.17.1.1.2-r10 |
| chainguard | ruby3.3-fluentd-kubernetes-daemonset-1.18 | 1.18.0.1.5-r5 |
| chainguard | ruby3.3-fluentd-kubernetes-daemonset-1.19 | 1.19.3.1.0-r0 |
| chainguard | ruby3.3-rails-7.2 | 7.2.3.1-r6 |
| chainguard | ruby3.3-rails-8.0 | 8.0.5-r6 |
| chainguard | ruby3.4-fluentd-kubernetes-daemonset-1.16 | 1.16.11.1.0-r4 |
| chainguard | ruby3.4-fluentd-kubernetes-daemonset-1.18 | 1.18.0.1.5-r4 |
| chainguard | ruby3.4-fluentd-kubernetes-daemonset-1.19 | 1.19.3.1.0-r0 |
| chainguard | ruby3.4-rails-7.2 | 7.2.3.1-r5 |
| chainguard | ruby3.4-rails-8.0 | 8.0.5-r5 |
| chainguard | ruby3.4-rails-8.1 | 8.1.3-r7 |
| chainguard | ruby4.0-fluentd-kubernetes-daemonset-1.16 | 1.16.11.1.0-r5 |
| chainguard | ruby4.0-fluentd-kubernetes-daemonset-1.18 | 1.18.0.1.5-r4 |
| chainguard | ruby4.0-fluentd-kubernetes-daemonset-1.19 | 1.19.3.1.0-r0 |
| chainguard | ruby4.0-rails-7.2 | 7.2.3.1-r5 |
| chainguard | ruby4.0-rails-8.0 | 8.0.5-r5 |
| debian 11 | ruby-concurrent | no fix listed |
| debian 12 | ruby-concurrent | no fix listed |
| debian 13 | ruby-concurrent | no fix listed |
| debian 14 | ruby-concurrent | 1.3.7-1 |
| echo | ruby-concurrent | no fix listed |
| minimos | logstash-8.19 | 8.19.21-r0 |
| minimos | logstash-9.4 | 9.4.6-r0 |
| minimos | logstash-9.5 | 9.5.2-r0 |
| minimos | ruby3.2-concurrent-ruby | 1.3.7-r0 |
| minimos | ruby3.4-concurrent-ruby | 1.3.7-r0 |
| minimos | ruby3.4-fluentd-kubernetes-daemonset-1.19 | 1.19.3.1.0-r0 |
| minimos | ruby4.0-concurrent-ruby | 1.3.7-r0 |
| minimos | ruby4.0-fluentd-kubernetes-daemonset-1.19 | 1.19.3.1.0-r0 |
| rapidfort debian 12 | ruby-concurrent | 0:1.3.7-1 |
| rapidfort debian 13 | ruby-concurrent | 0:1.3.7-1 |
| rubygems::GitHub Security Advisory RubyGems | concurrent-ruby | 1.3.7 |
| rubygems::Ruby Advisory Database | concurrent-ruby | >= 1.3.7 |
| wolfi | cinc-auditor | 7.1.7-r7 |
| wolfi | kube-fluentd-operator | 1.18.2-r71 |
| wolfi | kube-logging-operator | 6.7.0-r5 |
| wolfi | logstash-9.4 | 9.4.6-r0 |
| wolfi | ruby3.2-fluentd-kubernetes-daemonset-1.19 | 1.19.2.1.1-r5 |
| wolfi | ruby3.2-rails-8.1 | 8.1.3-r6 |
| wolfi | ruby3.3-fluentd-kubernetes-daemonset-1.19 | 1.19.3.1.0-r0 |
| wolfi | ruby3.4-fluentd-kubernetes-daemonset-1.19 | 1.19.3.1.0-r0 |
| wolfi | ruby3.4-rails-8.1 | 8.1.3-r7 |
| wolfi | ruby4.0-fluentd-kubernetes-daemonset-1.19 | 1.19.3.1.0-r0 |
References
- https://access.redhat.com/security/cve/CVE-2026-54906
- https://advisories.gitlab.com/gem/concurrent-ruby/CVE-2026-54906
- https://github.com/advisories/GHSA-6wx8-w4f5-wwcr
- https://github.com/ruby-concurrency/concurrent-ruby
- https://github.com/ruby-concurrency/concurrent-ruby/releases/tag/v1.3.7
- https://github.com/ruby-concurrency/concurrent-ruby/security/advisories/GHSA-6wx8-w4f5-wwcr
- https://nvd.nist.gov/vuln/detail/CVE-2026-54906
- https://rubygems.org/gems/concurrent-ruby/versions/1.3.7