CVE-2026-54904: Concurrent Ruby : `AtomicReference#update` livelocks when the stored value is `Float::NAN`
(updated )
Concurrent::AtomicReference#update can enter a permanent busy retry loop when the current value is Float::NAN.
The issue is caused by the interaction between:
AtomicReference#update, which retries untilcompare_and_set(old_value, new_value)succeeds.- Numeric
compare_and_set, which checksold == old_valuebefore attempting the underlying atomic swap. - Ruby NaN semantics, where
Float::NAN == Float::NANis alwaysfalse.
As a result, once an AtomicReference contains Float::NAN, calling #update repeatedly evaluates the caller’s block and never returns. In services that store externally derived numeric values in an AtomicReference, this can cause CPU exhaustion or permanent request/job hangs.
References
- github.com/advisories/GHSA-h8w8-99g7-qmvj
- github.com/ruby-concurrency/concurrent-ruby/commit/6e37e0644b83b182971dc540d2e4bee38df61386
- github.com/ruby-concurrency/concurrent-ruby/releases/tag/v1.3.7
- github.com/ruby-concurrency/concurrent-ruby/security/advisories/GHSA-h8w8-99g7-qmvj
- github.com/rubysec/ruby-advisory-db/blob/master/gems/concurrent-ruby/CVE-2026-54904.yml
- nvd.nist.gov/vuln/detail/CVE-2026-54904
- www.cve.org/CVERecord/SearchResults?query=CVE-2026-54904
Code Behaviors & Features
Detect and mitigate CVE-2026-54904 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →