concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReentrantReadWriteLock can incorrectly grant a write lock after one thread acquires the read lock 32,768 times. The lock stores a thread's local read and write hold counts in one integer. The low 15 bits are used for the read hold count, and bit 15 is used as WRITE_LOCK_HELD. After 32,768 reentrant read acquisitions, the local read count crosses into the write-lock bit. try_write_lock then treats the thread as already holding a write lock and returns true without setting the global RUNNING_WRITER bit. This breaks the core mutual-exclusion guarantee: the caller is told it has a write lock, but other threads can still hold or acquire read locks at the same time. This vulnerability is fixed in 1.3.7.

An update of the rubygem package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReentrantReadWriteLock     can incorrectly grant a write lock after one thread acquires the read lock 32,768 times. The lock stores a     thread's local read and write hold counts in one integer. The low 15 bits are used for the read hold     count, and bit 15 is used as WRITE_LOCK_HELD. After 32,768 reentrant read acquisitions, the local read     count crosses into the write-lock bit. try_write_lock then treats the thread as already holding a write     lock and returns true without setting the global RUNNING_WRITER bit. This breaks the core mutual-exclusion     guarantee: the caller is told it has a write lock, but other threads can still hold or acquire read locks     at the same time. This vulnerability is fixed in 1.3.7. (CVE-2026-54905)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReentrantReadWriteLock
    can incorrectly grant a write lock after one thread acquires the read lock 32,768 times. The lock stores a
    thread's local read and write hold counts in one integer. The low 15 bits are used for the read hold
    count, and bit 15 is used as WRITE_LOCK_HELD. After 32,768 reentrant read acquisitions, the local read
    count crosses into the write-lock bit. try_write_lock then treats the thread as already holding a write
    lock and returns true without setting the global RUNNING_WRITER bit. This breaks the core mutual-exclusion
    guarantee: the caller is told it has a write lock, but other threads can still hold or acquire read locks
    at the same time. This vulnerability is fixed in 1.3.7. (CVE-2026-54905)

ID	Name	Product	Family	Severity
325969	Photon OS 4.0: Rubygem PHSA-2026-4.0-1052	Nessus	PhotonOS Local Security Checks	high
323931	Photon OS 5.0: Rubygem PHSA-2026-5.0-0909	Nessus	PhotonOS Local Security Checks	high
322702	Linux Distros Unpatched Vulnerability : CVE-2026-54905	Nessus	Misc.	low
443621	SCA: security update for concurrent-ruby (GHSA-wv3x-4vxv-whpp)	Tenable Cloud Security	SCA Checks	low
443621	SCA: security update for concurrent-ruby (GHSA-wv3x-4vxv-whpp)	Tenable Self-Hosted Container Security	SCA Checks	low

Detections

Analytics

CVE-2026-54905

low

Tenable Plugins

high

high

low

low

low