Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
ruby-concurrency concurrent-ruby — concurrent-ruby: `AtomicReference#update` livelocks when the stored value is `Float::NAN`
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV
N L P N N N N H 8.2 .0041 34.6 —
AFFECTED
Product Versions Fixed
concurrent-ruby < 1.3.7 – —
TIMELINE
Jun 16 Reserved by GitHub_M
Jun 24 EXPLOIT PUBLISHED — CVE-2026-54904 (ruby-concurrency concurrent-ruby). Public exploit reference added.
Jun 24 Published (CNA: GitHub_M)
Aug 5 EXPLOIT PUBLISHED — CVE-2026-54904 (ruby-concurrency concurrent-ruby). Public exploit reference added.
Description
concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::AtomicReference#update can enter a permanent busy retry loop when the current value is Float::NAN. The issue is caused by the interaction between AtomicReference#update, which retries until compare_and_set(old_value, new_value) succeeds; Numeric compare_and_set, which checks old == old_value before attempting the underlying atomic swap.; and Ruby NaN semantics, where Float::NAN == Float::NAN is always false. As a result, once an AtomicReference contains Float::NAN, calling #update repeatedly evaluates the caller's block and never returns. In services that store externally derived numeric values in an AtomicReference, this can cause CPU exhaustion or permanent request/job hangs. This vulnerability is fixed in 1.3.7.
Lifecycle
Complete event history — 4 events, chronological
| Date | Event | Detail |
|---|
| June 16, 2026 | Reserved | Reserved by GitHub_M |
| June 24, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-54904 (ruby-concurrency concurrent-ruby). Public exploit reference added. |
| June 24, 2026 | Published | Published (CNA: GitHub_M) |
| August 5, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-54904 (ruby-concurrency concurrent-ruby). Public exploit reference added. |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| ruby-concurrency | concurrent-ruby | — | < 1.3.7 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-54904 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.