CVE-2026-54904: Concurrent Ruby : `AtomicReference#update` livelocks when the stored value is `Float::NAN`
(updated )
Concurrent::AtomicReference#update can enter a permanent busy retry loop when the current value is Float::NAN.
The issue is caused by the interaction between:
AtomicReference#update, which retries untilcompare_and_set(old_value, new_value)succeeds.- Numeric
compare_and_set, which checksold == old_valuebefore attempting the underlying atomic swap. - Ruby NaN semantics, where
Float::NAN == Float::NANis alwaysfalse.
As a result, once an AtomicReference contains Float::NAN, calling #update repeatedly evaluates the caller’s block and never returns. In services that store externally derived numeric values in an AtomicReference, this can cause CPU exhaustion or permanent request/job hangs.
References
- github.com/advisories/GHSA-h8w8-99g7-qmvj
- github.com/ruby-concurrency/concurrent-ruby/commit/6e37e0644b83b182971dc540d2e4bee38df61386
- github.com/ruby-concurrency/concurrent-ruby/releases/tag/v1.3.7
- github.com/ruby-concurrency/concurrent-ruby/security/advisories/GHSA-h8w8-99g7-qmvj
- github.com/rubysec/ruby-advisory-db/blob/master/gems/concurrent-ruby/CVE-2026-54904.yml
- nvd.nist.gov/vuln/detail/CVE-2026-54904
- www.cve.org/CVERecord/SearchResults?query=CVE-2026-54904
Code Behaviors & Features
Detect and mitigate CVE-2026-54904 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →