Skip to content

[Aikido] Fix security issue in concurrent-ruby via minor version upgrade from 1.3.6 to 1.3.7 in docs - #22

Merged
dzikowski merged 1 commit into
mainfrom
fix/aikido-security-update-packages-121400876-1ejm
Sep 22, 2026
Merged

dzikowski merged 1 commit into
mainfrom
fix/aikido-security-update-packages-121400876-1ejm

Conversation

@aikido-autofix

Copy link
Copy Markdown
Contributor

Upgrade concurrent-ruby to fix critical synchronization vulnerabilities: improper lock release allowing concurrent writers, infinite loops with NaN values causing DoS, and write lock bypass after 32k read acquisitions.

✅ 3 CVEs resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue Severity           Description
CVE-2026-54906
🚨 CRITICAL
[concurrent-ruby] A synchronization vulnerability allows any thread to release another thread's write lock, enabling concurrent write access violations. Additionally, releasing a read lock without holding one corrupts the lock state, causing subsequent read acquisitions to fail.
CVE-2026-54904
HIGH
[concurrent-ruby] AtomicReference#update enters an infinite busy loop when the stored value is Float::NAN due to NaN comparison semantics, causing CPU exhaustion or permanent hangs in affected services.
CVE-2026-54905
MEDIUM
[concurrent-ruby] ReentrantReadWriteLock incorrectly grants write locks after 32,768 reentrant read acquisitions due to integer overflow in lock state tracking, breaking mutual exclusion and allowing concurrent read/write access. This enables data corruption and race conditions.

@dzikowski
dzikowski merged commit 577b6ce into main Sep 22, 2026
7 checks passed
@dzikowski
dzikowski deleted the fix/aikido-security-update-packages-121400876-1ejm branch September 22, 2026 10:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant