CVE-2026-54904

concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::AtomicReferenceupdate can enter a permanent busy retry loop when the current value is Float::NAN. The issue is caused by the interaction between AtomicReferenceupdate, which retries until compareandsetoldvalue,...

EUVD-2026-38810

concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::AtomicReferenceupdate can enter a permanent busy retry loop when the current value is Float::NAN. The issue is caused by the interaction between AtomicReferenceupdate, which retries until compareandsetoldvalue,...

CVE-2026-54904 concurrent-ruby: `AtomicReference#update` livelocks when the stored value is `Float::NAN`

concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::AtomicReferenceupdate can enter a permanent busy retry loop when the current value is Float::NAN. The issue is caused by the interaction between AtomicReferenceupdate, which retries until compareandsetoldvalue,...

CVE-2026-54905 concurrent-ruby: `ReentrantReadWriteLock` read-count overflow grants a write lock without exclusivity

concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReentrantReadWriteLock can incorrectly grant a write lock after one thread acquires the read lock 32,768 times. The lock stores a thread's local read and write hold counts in one integer. The low 15 bits are used...

CVE-2026-54905

concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReentrantReadWriteLock can incorrectly grant a write lock after one thread acquires the read lock 32,768 times. The lock stores a thread's local read and write hold counts in one integer. The low 15 bits are used...

CVE-2026-54905

CVE-2026-54905 affects the concurrent-ruby library, specifically Concurrent::ReentrantReadWriteLock. Before version 1.3.7, after a thread acquires the read lock 32,768 times, the local read count overflows into the WRITE_LOCK_HELD bit, causing try_write_lock to treat the thread as if it holds a w...

CVE-2026-54905

concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReentrantReadWriteLock can incorrectly grant a write lock after one thread acquires the read lock 32,768 times. The lock stores a thread's local read and write hold counts in one integer. The low 15 bits are used...

CVE-2026-54905 concurrent-ruby: `ReentrantReadWriteLock` read-count overflow grants a write lock without exclusivity

concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReentrantReadWriteLock can incorrectly grant a write lock after one thread acquires the read lock 32,768 times. The lock stores a thread's local read and write hold counts in one integer. The low 15 bits are used...

CVE-2026-54905 concurrent-ruby: `ReentrantReadWriteLock` read-count overflow grants a write lock without exclusivity

concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReentrantReadWriteLock can incorrectly grant a write lock after one thread acquires the read lock 32,768 times. The lock stores a thread's local read and write hold counts in one integer. The low 15 bits are used...

CVE-2026-54905

concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReentrantReadWriteLock can incorrectly grant a write lock after one thread acquires the read lock 32,768 times. The lock stores a thread's local read and write hold counts in one integer. The low 15 bits are used...

TencentOS Server 3: ruby:3.3 (TSSA-2026:0546)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0546 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

GHSA-WV3X-4VXV-WHPP vulnerabilities

Vulnerabilities for packages: ruby4.0-fluentd-kubernetes-daemonset, ruby3.2-rails, ruby3.2-fluentd-kubernetes-daemonset, ruby3.3-rails, ruby3.4-fluentd-kubernetes-daemonset, kube-logging-operator, ruby3.4-rails, ruby3.3-fluentd-kubernetes-daemonset, ruby4.0-rails, kube-fluentd-operator...

GHSA-6WX8-W4F5-WWCR vulnerabilities

Vulnerabilities for packages: ruby4.0-fluentd-kubernetes-daemonset, ruby3.2-rails, ruby3.2-fluentd-kubernetes-daemonset, ruby3.3-rails, ruby3.4-fluentd-kubernetes-daemonset, kube-logging-operator, ruby3.4-rails, ruby3.3-fluentd-kubernetes-daemonset, ruby4.0-rails, kube-fluentd-operator...

GHSA-H8W8-99G7-QMVJ vulnerabilities

Vulnerabilities for packages: ruby4.0-fluentd-kubernetes-daemonset, ruby3.2-rails, ruby3.2-fluentd-kubernetes-daemonset, ruby3.3-rails, ruby3.4-fluentd-kubernetes-daemonset, kube-logging-operator, ruby3.4-rails, ruby3.3-fluentd-kubernetes-daemonset, ruby4.0-rails, kube-fluentd-operator...

GHSA-WFPW-MMFH-QQ69 vulnerabilities

Vulnerabilities for packages: logstash, ruby3.2-rails, ruby3.3-rails, kube-logging-operator, pact-broker-docker, ruby3.4-rails, gitlab-rails-ce, pact-broker-docker-fips, logstash-fips, ruby4.0-rails...

GHSA-8678-W3JW-XFC2 vulnerabilities

Vulnerabilities for packages: logstash, ruby3.2-rails, ruby3.3-rails, kube-logging-operator, pact-broker-docker, ruby3.4-rails, gitlab-rails-ce, pact-broker-docker-fips, logstash-fips, ruby4.0-rails...

CVE-2026-54904 vulnerabilities

Vulnerabilities for packages: ruby4.0-fluentd-kubernetes-daemonset, ruby3.2-rails, ruby3.2-fluentd-kubernetes-daemonset, ruby3.3-rails, ruby3.4-fluentd-kubernetes-daemonset, kube-logging-operator, ruby3.4-rails, ruby3.3-fluentd-kubernetes-daemonset, ruby4.0-rails, kube-fluentd-operator...

GHSA-5V8H-3H3Q-446P vulnerabilities

Vulnerabilities for packages: logstash, ruby3.2-rails, ruby3.3-rails, kube-logging-operator, pact-broker-docker, ruby3.4-rails, gitlab-rails-ce, pact-broker-docker-fips, logstash-fips, ruby4.0-rails...

CVE-2026-54906 vulnerabilities

Vulnerabilities for packages: ruby4.0-fluentd-kubernetes-daemonset, ruby3.2-rails, ruby3.2-fluentd-kubernetes-daemonset, ruby3.3-rails, ruby3.4-fluentd-kubernetes-daemonset, kube-logging-operator, ruby3.4-rails, ruby3.3-fluentd-kubernetes-daemonset, ruby4.0-rails, kube-fluentd-operator...

GHSA-WJV4-X9W8-WM3H vulnerabilities

Vulnerabilities for packages: logstash, ruby3.2-rails, ruby3.3-rails, kube-logging-operator, pact-broker-docker, ruby3.4-rails, gitlab-rails-ce, pact-broker-docker-fips, logstash-fips, ruby4.0-rails...