CVE-2026-54904: Concurrent Ruby DOS Vulnerability

CVE-2026-54904 Overview

CVE-2026-54904 is an infinite loop vulnerability in the concurrent-ruby gem, a widely used concurrency toolkit for Ruby applications. The flaw exists in Concurrent::AtomicReference#update and is triggered when the stored value is Float::NAN. Because NaN comparisons in Ruby always return false, the internal compare_and_set operation can never succeed, causing the update loop to run indefinitely. Services that store externally derived numeric values in an AtomicReference can experience CPU exhaustion and permanent request or job hangs. The issue is fixed in version 1.3.7 and is tracked under CWE-835: Loop with Unreachable Exit Condition.

Critical Impact
A single NaN value reaching an AtomicReference can permanently hang Ruby workers and exhaust CPU resources across affected services.

Affected Products

concurrent-ruby gem versions prior to 1.3.7
Ruby applications using Concurrent::AtomicReference#update with numeric values
Services that store externally derived numeric inputs in atomic references

Discovery Timeline

2026-06-24 - CVE-2026-54904 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-54904

Vulnerability Analysis

The vulnerability resides in Concurrent::AtomicReference#update, which retries a user-supplied block until compare_and_set(old_value, new_value) returns true. For numeric values, compare_and_set first checks old == old_value before attempting the underlying atomic swap. Ruby's IEEE 754 semantics dictate that Float::NAN == Float::NAN always evaluates to false. Once an AtomicReference contains Float::NAN, the equality check fails on every iteration, and the loop never exits.

The defect maps to CWE-835, Loop with Unreachable Exit Condition. The attack vector is network-based when the NaN value originates from untrusted input such as JSON payloads, query parameters, or upstream service responses parsed into floats.

Root Cause

The root cause is a mismatch between the optimistic concurrency pattern used by AtomicReference#update and the non-reflexive equality of NaN under IEEE 754. The retry loop assumes that reading the same value back will satisfy the equality check, which holds for all normal Ruby objects but fails for Float::NAN. The library did not handle NaN as a special case before swapping.

Attack Vector

An attacker who can influence numeric input that an application stores in an AtomicReference can submit a value that parses to Float::NAN. Common parsers accept strings such as NaN or arithmetic expressions like 0.0/0.0 that resolve to NaN. After the NaN value is stored, any subsequent call to #update on that reference enters a permanent busy loop. The result is single-core CPU saturation per affected worker and hung request or background job processing. See the GitHub Security Advisory GHSA-h8w8-99g7-qmvj for the maintainer analysis.

Detection Methods for CVE-2026-54904

Indicators of Compromise

Ruby worker processes pinned at 100% CPU on a single core with no progress in request logs
Stack traces showing threads stuck inside Concurrent::AtomicReference#update or compare_and_set
Request timeouts and job queue backlogs correlated with traffic that contains NaN-producing numeric input

Detection Strategies

Inventory dependencies using bundle list or Gemfile.lock to identify concurrent-ruby versions earlier than 1.3.7
Audit application code for AtomicReference instances that store values derived from user input, JSON payloads, or external APIs
Add input validation tests that submit NaN, Infinity, and 0.0/0.0 to numeric endpoints and observe worker behavior

Monitoring Recommendations

Alert on sustained per-process CPU saturation in Ruby application servers combined with stalled request throughput
Capture periodic thread dumps from production workers and flag threads repeatedly observed inside concurrent-ruby update loops
Track parser warnings or rejections for non-finite floating-point inputs at API gateways

How to Mitigate CVE-2026-54904

Immediate Actions Required

Upgrade concurrent-ruby to version 1.3.7 or later across all Ruby services
Identify code paths that pass externally derived numeric values into AtomicReference#update and add NaN rejection at input boundaries
Restart Ruby workers after upgrade to clear any already-stored NaN values from in-memory references

Patch Information

The maintainers fixed the vulnerability in concurrent-ruby 1.3.7. Update the dependency in Gemfile, run bundle update concurrent-ruby, and redeploy. Refer to the GitHub Security Advisory for the full fix details and commit references.

Workarounds

Reject or sanitize NaN and non-finite floats at the API or deserialization layer using Float#finite? checks before storing values
Wrap numeric values in a custom object whose == method handles NaN reflexively, then store the wrapper in the AtomicReference
Replace AtomicReference#update with a Mutex-guarded update on hot paths that handle untrusted numeric input until the upgrade is deployed

bash

# Configuration example
# Pin concurrent-ruby to the patched version in Gemfile
gem 'concurrent-ruby', '>= 1.3.7'

# Apply the update
bundle update concurrent-ruby

# Verify the installed version
bundle list | grep concurrent-ruby