CVE-2026-54904
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The vulnerability in the concurrent-ruby library for Ruby causes the AtomicReference#update method to enter an infinite retry loop when the stored value is Float::NAN. This is because Float::NAN == Float::NAN always returns false, preventing the compare_and_set operation from succeeding.
Risk Assessment
An attacker can cause CPU exhaustion or permanent request/job hangs in services that store externally derived numeric values in an AtomicReference, leading to denial of service (DoS).
Recommendation
Immediately update the concurrent-ruby library to version 1.3.7 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::AtomicReference#update can enter a permanent busy retry loop when the current value is Float::NAN. The issue is caused by the interaction between AtomicReference#update, which retries until compare_and_set(old_value, new_value) succeeds; Numeric compare_and_set, which checks old == old_value before attempting the underlying atomic swap.; and Ruby NaN semantics, where Float::NAN == Float::NAN is always false. As a result, once an AtomicReference contains Float::NAN, calling #update repeatedly evaluates the caller's block and never returns. In services that store externally derived numeric values in an AtomicReference, this can cause CPU exhaustion or permanent request/job hangs. This vulnerability is fixed in 1.3.7.