{"id":"AZL-91287","summary":"CVE-2026-54906 affecting package rubygem-concurrent-ruby for versions less than 1.3.7-1","details":"concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReadWriteLock#release_write_lock does not verify that the calling thread acquired the write lock. Any thread with access to the lock object can release an active write lock held by another thread. A second writer can then enter its critical section while the first writer is still running. Concurrent::ReadWriteLock#release_read_lock also decrements the shared counter even when no read lock is held. Calling it on a fresh lock changes the counter from 0 to -1, after which normal read acquisition raises Concurrent::ResourceLimitError. This is a synchronization correctness issue in the public Concurrent::ReadWriteLock API. This vulnerability is fixed in 1.3.7.","modified":"2026-08-28T17:48:06.101926090Z","published":"2026-06-24T17:17:29Z","upstream":["CVE-2026-54906"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54906"}],"affected":[{"package":{"name":"rubygem-concurrent-ruby","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/rubygem-concurrent-ruby"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.7-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-91287.json"}}],"schema_version":"1.9.0"}