Before version 1.3.7, the concurrent-ruby library’s ReentrantReadWriteLock can overflow its internal read counter. After a thread acquires a read lock 32,768 times, the low‑15‑bit read counter overlaps the bit that flags a write lock. Subsequent attempts to obtain a write lock succeed because the function mistakenly interprets the overflowed counter as the thread already holding a write lock, yet it does not set the global RUNNING_WRITER flag. The caller is therefore granted what appears to be exclusive write access while other threads may continue to hold or acquire read locks, violating the core mutual‑exclusion guarantee and creating a race condition that can corrupt shared data.

Systems using ruby-concurrency:concurrent-ruby with any version older than 1.3.7 are affected. The vulnerability is fixed starting with version 1.3.7 and later.

The CVSS score of 2 indicates low severity. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog. An attacker would need the ability to repeatedly acquire the read lock 32,768 times within the same process, a scenario that typically requires either a flaw in application logic or the ability to execute code inside the target process. Consequently, exploitation probability is low and confined to local or application‑level contexts, with the primary impact being potential data corruption rather than remote code execution or denial of service.