# CVE-2026-54906: ruby-concurrency concurrent-ruby improper locking in ReadWriteLock

Source: https://junglewise.ai/threats/cve-2026-54906-ruby-concurrency-concurrent-ruby-improper-locking-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-24. Updated: 2026-06-24  
License: CC BY 4.0 with a link back

CVE-2026-54906 · Severity: medium · CVSS 4 · Published 2026-06-24

A flaw in a popular Ruby concurrency library could allow software threads to improperly release locks held by other threads. This can lead to data corruption if multiple processes try to modify the same data simultaneously, or cause the application to stop responding if the locking mechanism becomes unusable. The issue affects applications using specific manual locking tools within the library.

Technologies: [concurrent-ruby (RubyGems)](https://junglewise.ai/threats/technologies/concurrent-ruby). Vendors: [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-54906 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54906 being exploited in the wild.

**How severe is CVE-2026-54906?** Medium severity, with a CVSS score of 4, published 24 June 2026.

**Which products and versions are affected?** concurrent-ruby (RubyGems) < 1.3.7, ECOSYSTEM:introduced=0,fixed=1.3.7.

**Is there a fix for CVE-2026-54906?** Yes. concurrent-ruby (RubyGems): upgrade to 1.3.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54906 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-54906?** Check whether you run concurrent-ruby (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- concurrent-ruby (RubyGems): upgrade to 1.3.7 or later

  ```sh
  bundle update concurrent-ruby
  ```


## Technical details

A vulnerability exists in Concurrent::ReadWriteLock where the #release_write_lock method fails to verify if the calling thread is the actual owner of the lock. This allows an arbitrary thread to release a write lock held by another, potentially allowing a second writer to enter a critical section concurrently and causing data races. Additionally, #release_read_lock unconditionally decrements the internal counter even if no lock is held; calling this on a fresh lock results in a negative counter value, which causes subsequent read acquisitions to fail with a Concurrent::ResourceLimitError. These issues are addressed in version 1.3.7.

## Affected products

- ruby-concurrency concurrent-ruby < 1.3.7

## Identifiers

- CVE-2026-54906
- GHSA-6wx8-w4f5-wwcr

## Timeline

- 2026-06-16: advisory: GitHub security advisory published
- 2026-06-24: disclosed: CVE published to NVD

## References

- [https://github.com/ruby-concurrency/concurrent-ruby/security/advisories/GHSA-6wx8-w4f5-wwcr](https://github.com/ruby-concurrency/concurrent-ruby/security/advisories/GHSA-6wx8-w4f5-wwcr)

## Related threats

- [Ruby concurrent-ruby mutual exclusion bypass in ReentrantReadWriteLock](https://junglewise.ai/threats/cve-2026-54905-ruby-concurrent-ruby-mutual-exclusion-bypass-in)
- [ruby-concurrency concurrent-ruby denial of service in AtomicReference](https://junglewise.ai/threats/cve-2026-54904-ruby-concurrency-concurrent-ruby-denial-of-service-in)