CVE-2026-54906 discloses two synchronization bugs in the concurrent-ruby gem's ReadWriteLock implementation. First, release_write_lock does not verify the calling thread owns the lock, allowing any thread to release a write lock held by another thread, breaking mutual exclusion and enabling data races. Second, release_read_lock decrements the shared counter even when no read lock is held, corrupting the counter and causing ResourceLimitError on subsequent acquisitions. Both issues affect applications using the manual acquire_*/release_* API. The fix is available in concurrent-ruby v1.3.7.
206 Impressions