A permanent busy‑retry loop is triggered when Concurrent::AtomicReference#update attempts to update a reference that contains Float::NAN because NaN values never satisfy the equality check used by the compare_and_set operation. The result is continuous evaluation of the supplied block that never returns, consuming CPU resources or leaving requests or background jobs forever stuck. The vulnerability directly impacts the confidentiality, integrity, and availability of applications that rely on concurrent-ruby for thread‑safe numeric state, with the primary consequence being denial of service.

The issue appears in the concurrent-ruby library before version 1.3.7, specifically in any Ruby application that uses AtomicReference to hold external numeric values. Affecting the ruby‑concurrency:concurrent-ruby product, all releases older than 1.3.7 are vulnerable. Any service that stores a Float::NAN in an AtomicReference—through user input, external data, or internal calculations—could experience the livelock.

The CVSS score of 8.2 indicates a high severity vulnerability. Although the EPSS score is not available and the flaw is not listed in the CISA KEV catalog, the attack is trivial to trigger by simply inserting a NaN value into an AtomicReference that is then updated. The exploit requires no special privileges and can be performed from the application layer, leading to service degradation or complete failure. The lack of a publicly disclosed exploit suggests that the danger lies primarily in the potential for unbounded CPU cycles rather than immediate remote code execution.