Executive brief
A flaw in a popular Ruby concurrency library could allow software threads to improperly release locks held by other threads. This can lead to data corruption if multiple processes try to modify the same data simultaneously, or cause the application to stop responding if the locking mechanism becomes unusable. The issue affects applications using specific manual locking tools within the library.
Technical details
A vulnerability exists in Concurrent::ReadWriteLock where the #release_write_lock method fails to verify if the calling thread is the actual owner of the lock. This allows an arbitrary thread to release a write lock held by another, potentially allowing a second writer to enter a critical section concurrently and causing data races. Additionally, #release_read_lock unconditionally decrements the internal counter even if no lock is held; calling this on a fresh lock results in a negative counter value, which causes subsequent read acquisitions to fail with a Concurrent::ResourceLimitError. These issues are addressed in version 1.3.7.
Affected products
- ruby-concurrency concurrent-ruby < 1.3.7
Timeline
- 2026-06-16: advisory: GitHub security advisory published
- 2026-06-24: disclosed: CVE published to NVD