concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::AtomicReference#update can enter a permanent busy retry loop when the current value is Float::NAN. The issue is caused by the interaction between AtomicReference#update, which retries until compare_and_set(old_value, new_value) succeeds; Numeric compare_and_set, which checks old == old_value before attempting the underlying atomic swap.; and Ruby NaN semantics, where Float::NAN == Float::NAN is always false. As a result, once an AtomicReference contains Float::NAN, calling #update repeatedly evaluates the caller's block and never returns. In services that store externally derived numeric values in an AtomicReference, this can cause CPU exhaustion or permanent request/job hangs. This vulnerability is fixed in 1.3.7.

An update of the rubygem package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::AtomicReference#update     can enter a permanent busy retry loop when the current value is Float::NAN. The issue is caused by the     interaction between AtomicReference#update, which retries until compare_and_set(old_value, new_value)     succeeds; Numeric compare_and_set, which checks old == old_value before attempting the underlying atomic     swap.; and Ruby NaN semantics, where Float::NAN == Float::NAN is always false. As a result, once an     AtomicReference contains Float::NAN, calling #update repeatedly evaluates the caller's block and never     returns. In services that store externally derived numeric values in an AtomicReference, this can cause     CPU exhaustion or permanent request/job hangs. This vulnerability is fixed in 1.3.7. (CVE-2026-54904)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::AtomicReference#update
    can enter a permanent busy retry loop when the current value is Float::NAN. The issue is caused by the
    interaction between AtomicReference#update, which retries until compare_and_set(old_value, new_value)
    succeeds; Numeric compare_and_set, which checks old == old_value before attempting the underlying atomic
    swap.; and Ruby NaN semantics, where Float::NAN == Float::NAN is always false. As a result, once an
    AtomicReference contains Float::NAN, calling #update repeatedly evaluates the caller's block and never
    returns. In services that store externally derived numeric values in an AtomicReference, this can cause
    CPU exhaustion or permanent request/job hangs. This vulnerability is fixed in 1.3.7. (CVE-2026-54904)

ID	Name	Product	Family	Severity
325969	Photon OS 4.0: Rubygem PHSA-2026-4.0-1052	Nessus	PhotonOS Local Security Checks	high
323931	Photon OS 5.0: Rubygem PHSA-2026-5.0-0909	Nessus	PhotonOS Local Security Checks	high
322649	Linux Distros Unpatched Vulnerability : CVE-2026-54904	Nessus	Misc.	high
443662	SCA: security update for concurrent-ruby (GHSA-h8w8-99g7-qmvj)	Tenable Cloud Security	SCA Checks	high
443662	SCA: security update for concurrent-ruby (GHSA-h8w8-99g7-qmvj)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-54904

high

Tenable Plugins

high

high

high

high

high