{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-54906", "tracking": { "current_release_date": "2026-10-21T16:27:08.459088Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-54906", "initial_release_date": "2026-06-19T21:40:11.805693Z", "revision_history": [ { "date": "2026-06-19T21:40:11.805693Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (2).| CWES updated (1)." }, { "date": "2026-06-19T21:40:15.357513Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-06-20T00:41:46.317017Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (78).| Product Identifiers created (77).| References created (1).| CWES updated (1)." }, { "date": "2026-06-20T00:41:57.980815Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-06-24T16:48:23.207528Z", "number": "5", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| References created (1).| CWES updated (1)." }, { "date": "2026-06-24T16:48:24.740059Z", "number": "6", "summary": "NCSC Score updated." }, { "date": "2026-06-24T18:50:19.005289Z", "number": "7", "summary": "Unknown change." }, { "date": "2026-06-24T18:53:39.256985Z", "number": "8", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (1).| CWES updated (1)." }, { "date": "2026-06-24T18:53:44.402813Z", "number": "9", "summary": "NCSC Score updated." }, { "date": "2026-06-25T00:45:30.258756Z", "number": "10", "summary": "Source created.| CVE status created. (valid)| Products created (2)." }, { "date": "2026-06-25T06:44:45.676676Z", "number": "11", "summary": "Description created for source." }, { "date": "2026-06-26T00:28:23.865910Z", "number": "12", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (15).| Product Identifiers created (3).| Product Remediations created (17).| Products created (2).| References created (3).| CWES updated (1).| Vendor_assessment created." }, { "date": "2026-06-26T00:28:27.872615Z", "number": "13", "summary": "NCSC Score updated." }, { "date": "2026-06-26T01:20:28.535544Z", "number": "14", "summary": "Source connected.| CVE status created. (valid)| EPSS created." }, { "date": "2026-06-26T01:20:35.847126Z", "number": "15", "summary": "NCSC Score updated." }, { "date": "2026-06-26T20:32:47.961825Z", "number": "16", "summary": "CVSS created.| Products created (1).| Product Identifiers created (1)." }, { "date": "2026-06-26T20:32:55.338219Z", "number": "17", "summary": "NCSC Score updated." }, { "date": "2026-06-28T12:21:40.330845Z", "number": "18", "summary": "Source connected.| CVE status created. (valid)| Description created for source.| CVSS created.| CWES updated (1)." }, { "date": "2026-07-03T12:20:25.723559Z", "number": "19", "summary": "Products created (1).| Product Identifiers created (1).| Product Remediations created (1)." }, { "date": "2026-07-03T12:20:27.804101Z", "number": "20", "summary": "NCSC Score updated." }, { "date": "2026-07-14T02:10:01.065170Z", "number": "21", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (86).| References created (3).| CWES updated (1)." }, { "date": "2026-07-14T02:10:21.097964Z", "number": "22", "summary": "NCSC Score updated." }, { "date": "2026-07-19T18:47:59.106971Z", "number": "23", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (3).| CWES updated (1)." }, { "date": "2026-07-19T18:48:02.668269Z", "number": "24", "summary": "NCSC Score updated." }, { "date": "2026-08-11T15:18:41.932810Z", "number": "25", "summary": "Source connected.| CVE status created. (valid)| EPSS created." }, { "date": "2026-08-11T15:19:45.318721Z", "number": "26", "summary": "NCSC Score updated." }, { "date": "2026-08-19T18:22:36.807553Z", "number": "27", "summary": "Products removed (1)." }, { "date": "2026-08-19T18:22:39.162043Z", "number": "28", "summary": "NCSC Score updated." }, { "date": "2026-09-01T21:56:38.742000Z", "number": "29", "summary": "Description removed for source.| Products removed (1)." }, { "date": "2026-09-01T21:56:40.014616Z", "number": "30", "summary": "NCSC Score updated." }, { "date": "2026-09-02T04:17:26.667999Z", "number": "31", "summary": "Description created for source." }, { "date": "2026-09-02T10:27:57.217072Z", "number": "32", "summary": "EPSS updated." }, { "date": "2026-09-03T00:27:16.396221Z", "number": "33", "summary": "NCSC Score updated." }, { "date": "2026-09-03T14:17:36.171773Z", "number": "34", "summary": "EPSS updated." }, { "date": "2026-09-03T18:41:59.398227Z", "number": "35", "summary": "EPSS updated." }, { "date": "2026-09-04T15:26:16.023508Z", "number": "36", "summary": "EPSS updated." }, { "date": "2026-09-04T15:26:17.227671Z", "number": "37", "summary": "NCSC Score updated." }, { "date": "2026-09-05T15:25:33.316303Z", "number": "38", "summary": "EPSS updated." }, { "date": "2026-09-06T15:25:58.345604Z", "number": "39", "summary": "EPSS updated." }, { "date": "2026-09-07T15:26:34.926952Z", "number": "40", "summary": "EPSS updated." }, { "date": "2026-09-09T07:20:11.334568Z", "number": "41", "summary": "EPSS updated." }, { "date": "2026-09-09T15:30:32.482316Z", "number": "42", "summary": "EPSS updated." }, { "date": "2026-09-29T15:43:10.084736Z", "number": "43", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-29T15:43:14.411560Z", "number": "44", "summary": "NCSC Score updated." }, { "date": "2026-10-21T00:31:48.041507Z", "number": "45", "summary": "Source connected.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (2).| Product Remediations created (2).| References created (2)." }, { "date": "2026-10-21T00:31:49.884855Z", "number": "46", "summary": "NCSC Score updated." }, { "date": "2026-10-21T14:44:00.818139Z", "number": "47", "summary": "Source connected.| CVE status created. (valid)" }, { "date": "2026-10-21T14:44:10.988744Z", "number": "48", "summary": "NCSC Score updated." }, { "date": "2026-10-21T16:16:42.839216Z", "number": "49", "summary": "Source connected.| CVE status created. (valid)| Products connected (28).| References created (3)." }, { "date": "2026-10-21T16:16:51.068205Z", "number": "50", "summary": "NCSC Score updated." }, { "date": "2026-10-21T16:27:01.879118Z", "number": "51", "summary": "Source connected.| CVE status created. (valid)| Products connected (3).| References created (3)." }, { "date": "2026-10-21T16:27:05.924917Z", "number": "52", "summary": "NCSC Score updated." } ], "status": "interim", "version": "52" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/11", "product": { "name": "vers:unknown/11", "product_id": "CSAFPID-6213344", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:11.0" } } }, { "category": "product_version_range", "name": "vers:unknown/14", "product": { "name": "vers:unknown/14", "product_id": "CSAFPID-1846967", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:14.0" } } }, { "category": "product_version_range", "name": "vers:unknown/15.0.0.0.0", "product": { "name": "vers:unknown/15.0.0.0.0", "product_id": "CSAFPID-1350134", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:15.0.0.0.0" } } }, { "category": "product_version_range", "name": "vers:unknown/15.0.1.0.0", "product": { "name": "vers:unknown/15.0.1.0.0", "product_id": "CSAFPID-5452530", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:15.0.1.0.0" } } }, { "category": "product_version_range", "name": "vers:unknown/15.1.0.0.0", "product": { "name": "vers:unknown/15.1.0.0.0", "product_id": "CSAFPID-5452533", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:15.1.0.0.0" } } }, { "category": "product_version_range", "name": "vers:unknown/15.2.0.0.0", "product": { "name": "vers:unknown/15.2.0.0.0", "product_id": "CSAFPID-8469661", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:15.2.0.0.0" } } }, { "category": "product_version_range", "name": "vers:unknown/24.2.4-25.2.000", "product": { "name": "vers:unknown/24.2.4-25.2.000", "product_id": "CSAFPID-9794255", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:24.2.4-25.2.000" } } }, { "category": "product_version_range", "name": "vers:unknown/25.1.100", "product": { "name": "vers:unknown/25.1.100", "product_id": "CSAFPID-2726924", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:25.1.100" } } }, { "category": "product_version_range", "name": "vers:unknown/25.1.200", "product": { "name": "vers:unknown/25.1.200", "product_id": "CSAFPID-5452528", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:25.1.200" } } }, { "category": "product_version_range", "name": "vers:unknown/25.2.100", "product": { "name": "vers:unknown/25.2.100", "product_id": "CSAFPID-5129856", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:25.2.100" } } }, { "category": "product_version_range", "name": "vers:unknown/25.2.200", "product": { "name": "vers:unknown/25.2.200", "product_id": "CSAFPID-6213342", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:25.2.200" } } }, { "category": "product_version_range", "name": "vers:unknown/25.2.201", "product": { "name": "vers:unknown/25.2.201", "product_id": "CSAFPID-9794259", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:25.2.201" } } }, { "category": "product_version_range", "name": "vers:unknown/25.2.202", "product": { "name": "vers:unknown/25.2.202", "product_id": "CSAFPID-9794251", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:25.2.202" } } }, { "category": "product_version_range", "name": "vers:unknown/26.1.200", "product": { "name": "vers:unknown/26.1.200", "product_id": "CSAFPID-9794254", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:26.1.200" } } }, { "category": "product_version_range", "name": "vers:unknown/26.1.202", "product": { "name": "vers:unknown/26.1.202", "product_id": "CSAFPID-9794257", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:26.1.202" } } }, { "category": "product_version_range", "name": "vers:unknown/47.0.0.2.0", "product": { "name": "vers:unknown/47.0.0.2.0", "product_id": "CSAFPID-9794256", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:47.0.0.2.0" } } }, { "category": "product_version_range", "name": "vers:unknown/6", "product": { "name": "vers:unknown/6", "product_id": "CSAFPID-5129855", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:6.0" } } }, { "category": "product_version_range", "name": "vers:unknown/6.1", "product": { "name": "vers:unknown/6.1", "product_id": "CSAFPID-5452527", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:6.1" } } }, { "category": "product_version_range", "name": "vers:unknown/6.1.1-7.0.0", "product": { "name": "vers:unknown/6.1.1-7.0.0", "product_id": "CSAFPID-9010919", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:6.1.1-7.0.0" } } }, { "category": "product_version_range", "name": "vers:unknown/7.0.0", "product": { "name": "vers:unknown/7.0.0", "product_id": "CSAFPID-9794252", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:7.0.0" } } }, { "category": "product_version_range", "name": "vers:unknown/7.5.0", "product": { "name": "vers:unknown/7.5.0", "product_id": "CSAFPID-5452523", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:7.5.0" } } }, { "category": "product_version_range", "name": "vers:unknown/7.5.1", "product": { "name": "vers:unknown/7.5.1", "product_id": "CSAFPID-9794258", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:7.5.1" } } }, { "category": "product_version_range", "name": "vers:unknown/7.6.0", "product": { "name": "vers:unknown/7.6.0", "product_id": "CSAFPID-6213349", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:7.6.0" } } }, { "category": "product_version_range", "name": "vers:unknown/7.7.0", "product": { "name": "vers:unknown/7.7.0", "product_id": "CSAFPID-5452536", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:7.7.0" } } }, { "category": "product_version_range", "name": "vers:unknown/7.8.0", "product": { "name": "vers:unknown/7.8.0", "product_id": "CSAFPID-5452531", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:7.8.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.0-8.1", "product": { "name": "vers:unknown/8.0-8.1", "product_id": "CSAFPID-9794260", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:8.0-8.1" } } }, { "category": "product_version_range", "name": "vers:unknown/8.0-8.3", "product": { "name": "vers:unknown/8.0-8.3", "product_id": "CSAFPID-9794253", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:8.0-8.3" } } }, { "category": "product_version_range", "name": "vers:unknown/8.0.1", "product": { "name": "vers:unknown/8.0.1", "product_id": "CSAFPID-9010916", "product_identification_helper": { "cpe": "cpe:/a:oracle:communications:8.0.1" } } } ], "category": "product_name", "name": "Communications" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:oracle/>=6.1.1|<=7.0.0", "product": { "name": "vers:oracle/>=6.1.1|<=7.0.0", "product_id": "CSAFPID-6212729", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:communications_unified_assurance:6.1.1-7.0.0:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "Oracle Communications Unified Assurance" } ], "category": "product_family", "name": "Oracle Communications" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/17.0-26.9", "product": { "name": "vers:unknown/17.0-26.9", "product_id": "CSAFPID-9794323", "product_identification_helper": { "cpe": "cpe:/a:oracle:siebel_crm:17.0-26.9" } } }, { "category": "product_version_range", "name": "vers:unknown/22.3-26.9", "product": { "name": "vers:unknown/22.3-26.9", "product_id": "CSAFPID-9794324", "product_identification_helper": { "cpe": "cpe:/a:oracle:siebel_crm:22.3-26.9" } } }, { "category": "product_version_range", "name": "vers:unknown/25.12-26.9", "product": { "name": "vers:unknown/25.12-26.9", "product_id": "CSAFPID-9794325", "product_identification_helper": { "cpe": "cpe:/a:oracle:siebel_crm:25.12-26.9" } } } ], "category": "product_name", "name": "Siebel CRM" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:oracle/>=17.0|<=26.9", "product": { "name": "vers:oracle/>=17.0|<=26.9", "product_id": "CSAFPID-9763668", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:siebel_crm_end_user:17.0-26.9:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "Siebel CRM End User" } ], "category": "product_family", "name": "Oracle Siebel CRM" } ], "category": "vendor", "name": "Oracle" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/2", "product": { "name": "vers:rpm/2", "product_id": "CSAFPID-1439310", "product_identification_helper": { "cpe": "cpe:/a:redhat:red_hat_3scale_amp:2" } } } ], "category": "product_name", "name": "Red Hat 3scale API Management Platform 2" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/17.1", "product": { "name": "vers:rpm/17.1", "product_id": "CSAFPID-1441193", "product_identification_helper": { "cpe": "cpe:/a:redhat:openstack:17.1" } } } ], "category": "product_name", "name": "Red Hat OpenStack Platform 17.1" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/6", "product": { "name": "vers:rpm/6", "product_id": "CSAFPID-1439313", "product_identification_helper": { "cpe": "cpe:/a:redhat:satellite:6" } } } ], "category": "product_name", "name": "Red Hat Satellite 6" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5499196" } } ], "category": "product_name", "name": "backend" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5499198" } } ], "category": "product_name", "name": "backend-rhel8" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5360337" } } ], "category": "product_name", "name": "system" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5360339" } } ], "category": "product_name", "name": "system-rhel7" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5360342" } } ], "category": "product_name", "name": "system-rhel8" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5360344" } } ], "category": "product_name", "name": "system-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-6009840" } } ], "category": "product_name", "name": "toolbox" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-6009841" } } ], "category": "product_name", "name": "toolbox-rhel8" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-6009842" } } ], "category": "product_name", "name": "toolbox-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5011661" } } ], "category": "product_name", "name": "zync" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-2821639" } } ], "category": "product_name", "name": "zync-rhel8" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-2821640" } } ], "category": "product_name", "name": "zync-rhel9" } ], "category": "product_family", "name": "Red Hat 3scale API Management Platform 2" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-8502064" } } ], "category": "product_name", "name": "rubygem-concurrent-ruby" } ], "category": "product_family", "name": "Red Hat OpenStack Platform 17.1" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-8502065" } } ], "category": "product_name", "name": "rubygem-concurrent-ruby" } ], "category": "product_family", "name": "Red Hat Satellite 6" } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/0.0.1", "product": { "name": "vers:unknown/0.0.1", "product_id": "CSAFPID-8482133", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.0.1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.0", "product": { "name": "vers:unknown/0.1.0", "product_id": "CSAFPID-8482134", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.1.0" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.1", "product": { "name": "vers:unknown/0.1.1", "product_id": "CSAFPID-8482135", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.1.1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.1.pre.1", "product": { "name": "vers:unknown/0.1.1.pre.1", "product_id": "CSAFPID-8482136", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.1.1.pre.1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.1.pre.2", "product": { "name": "vers:unknown/0.1.1.pre.2", "product_id": "CSAFPID-8482137", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.1.1.pre.2" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.1.pre.3", "product": { "name": "vers:unknown/0.1.1.pre.3", "product_id": "CSAFPID-8482138", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.1.1.pre.3" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.1.pre.4", "product": { "name": "vers:unknown/0.1.1.pre.4", "product_id": "CSAFPID-8482139", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.1.1.pre.4" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.1.pre.5", "product": { "name": "vers:unknown/0.1.1.pre.5", "product_id": "CSAFPID-8482140", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.1.1.pre.5" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.0", "product": { "name": "vers:unknown/0.2.0", "product_id": "CSAFPID-8482141", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.2.0" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.1", "product": { "name": "vers:unknown/0.2.1", "product_id": "CSAFPID-8482142", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.2.1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.2", "product": { "name": "vers:unknown/0.2.2", "product_id": "CSAFPID-8482143", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.2.2" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.0", "product": { "name": "vers:unknown/0.3.0", "product_id": "CSAFPID-8482144", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.3.0" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.0.pre.1", "product": { "name": "vers:unknown/0.3.0.pre.1", "product_id": "CSAFPID-8482145", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.3.0.pre.1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.0.pre.2", "product": { "name": "vers:unknown/0.3.0.pre.2", "product_id": "CSAFPID-8482146", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.3.0.pre.2" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.0.pre.3", "product": { "name": "vers:unknown/0.3.0.pre.3", "product_id": "CSAFPID-8482147", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.3.0.pre.3" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.1", "product": { "name": "vers:unknown/0.3.1", "product_id": "CSAFPID-8482148", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.3.1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.1.pre.1", "product": { "name": "vers:unknown/0.3.1.pre.1", "product_id": "CSAFPID-8482149", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.3.1.pre.1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.1.pre.2", "product": { "name": "vers:unknown/0.3.1.pre.2", "product_id": "CSAFPID-8482150", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.3.1.pre.2" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.2", "product": { "name": "vers:unknown/0.3.2", "product_id": "CSAFPID-8482151", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.3.2" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.0", "product": { "name": "vers:unknown/0.4.0", "product_id": "CSAFPID-8482152", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.4.0" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.1", "product": { "name": "vers:unknown/0.4.1", "product_id": "CSAFPID-8482153", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.4.1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.0", "product": { "name": "vers:unknown/0.5.0", "product_id": "CSAFPID-8482154", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.5.0" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.0.pre.1", "product": { "name": "vers:unknown/0.5.0.pre.1", "product_id": "CSAFPID-8482155", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.5.0.pre.1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.0", "product": { "name": "vers:unknown/0.6.0", "product_id": "CSAFPID-8482156", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.6.0" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.0.pre.1", "product": { "name": "vers:unknown/0.6.0.pre.1", "product_id": "CSAFPID-8482157", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.6.0.pre.1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.0.pre.2", "product": { "name": "vers:unknown/0.6.0.pre.2", "product_id": "CSAFPID-8482158", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.6.0.pre.2" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.1", "product": { "name": "vers:unknown/0.6.1", "product_id": "CSAFPID-8482159", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.6.1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.7.0", "product": { "name": "vers:unknown/0.7.0", "product_id": "CSAFPID-8482160", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.7.0" } } }, { "category": "product_version_range", "name": "vers:unknown/0.7.0.rc0", "product": { "name": "vers:unknown/0.7.0.rc0", "product_id": "CSAFPID-8482161", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.7.0.rc0" } } }, { "category": "product_version_range", "name": "vers:unknown/0.7.0.rc1", "product": { "name": "vers:unknown/0.7.0.rc1", "product_id": "CSAFPID-8482162", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.7.0.rc1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.7.0.rc2", "product": { "name": "vers:unknown/0.7.0.rc2", "product_id": "CSAFPID-8482163", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.7.0.rc2" } } }, { "category": "product_version_range", "name": "vers:unknown/0.7.1", "product": { "name": "vers:unknown/0.7.1", "product_id": "CSAFPID-8482164", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.7.1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.7.2", "product": { "name": "vers:unknown/0.7.2", "product_id": "CSAFPID-8482165", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.7.2" } } }, { "category": "product_version_range", "name": "vers:unknown/0.8.0", "product": { "name": "vers:unknown/0.8.0", "product_id": "CSAFPID-8482166", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.8.0" } } }, { "category": "product_version_range", "name": "vers:unknown/0.8.0.pre1", "product": { "name": "vers:unknown/0.8.0.pre1", "product_id": "CSAFPID-8482167", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.8.0.pre1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.8.0.pre2", "product": { "name": "vers:unknown/0.8.0.pre2", "product_id": "CSAFPID-8482168", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.8.0.pre2" } } }, { "category": "product_version_range", "name": "vers:unknown/0.9.0", "product": { "name": "vers:unknown/0.9.0", "product_id": "CSAFPID-8482169", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.9.0" } } }, { "category": "product_version_range", "name": "vers:unknown/0.9.0.pre2", "product": { "name": "vers:unknown/0.9.0.pre2", "product_id": "CSAFPID-8482170", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.9.0.pre2" } } }, { "category": "product_version_range", "name": "vers:unknown/0.9.0.pre3", "product": { "name": "vers:unknown/0.9.0.pre3", "product_id": "CSAFPID-8482171", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.9.0.pre3" } } }, { "category": "product_version_range", "name": "vers:unknown/0.9.1", "product": { "name": "vers:unknown/0.9.1", "product_id": "CSAFPID-8482172", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.9.1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.9.2", "product": { "name": "vers:unknown/0.9.2", "product_id": "CSAFPID-8482173", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@0.9.2" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0", "product": { "name": "vers:unknown/1.0.0", "product_id": "CSAFPID-8482174", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.0.0" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0.pre1", "product": { "name": "vers:unknown/1.0.0.pre1", "product_id": "CSAFPID-8482175", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.0.0.pre1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0.pre2", "product": { "name": "vers:unknown/1.0.0.pre2", "product_id": "CSAFPID-8482176", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.0.0.pre2" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0.pre3", "product": { "name": "vers:unknown/1.0.0.pre3", "product_id": "CSAFPID-8482177", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.0.0.pre3" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0.pre4", "product": { "name": "vers:unknown/1.0.0.pre4", "product_id": "CSAFPID-8482178", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.0.0.pre4" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0.pre5", "product": { "name": "vers:unknown/1.0.0.pre5", "product_id": "CSAFPID-8482179", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.0.0.pre5" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.1", "product": { "name": "vers:unknown/1.0.1", "product_id": "CSAFPID-8482180", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.0.1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.2", "product": { "name": "vers:unknown/1.0.2", "product_id": "CSAFPID-8482181", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.0.2" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.3", "product": { "name": "vers:unknown/1.0.3", "product_id": "CSAFPID-8482182", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.0.3" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.3.pre3", "product": { "name": "vers:unknown/1.0.3.pre3", "product_id": "CSAFPID-8482183", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.0.3.pre3" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.4", "product": { "name": "vers:unknown/1.0.4", "product_id": "CSAFPID-8482184", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.0.4" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.5", "product": { "name": "vers:unknown/1.0.5", "product_id": "CSAFPID-8482185", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.0.5" } } }, { "category": "product_version_range", "name": "vers:unknown/1.1.0.pre1", "product": { "name": "vers:unknown/1.1.0.pre1", "product_id": "CSAFPID-8482186", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.1.0.pre1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.1.0.pre2", "product": { "name": "vers:unknown/1.1.0.pre2", "product_id": "CSAFPID-8482187", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.1.0.pre2" } } }, { "category": "product_version_range", "name": "vers:unknown/1.1.1", "product": { "name": "vers:unknown/1.1.1", "product_id": "CSAFPID-8482188", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.1.1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.1.10", "product": { "name": "vers:unknown/1.1.10", "product_id": "CSAFPID-8482189", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.1.10" } } }, { "category": "product_version_range", "name": "vers:unknown/1.1.2", "product": { "name": "vers:unknown/1.1.2", "product_id": "CSAFPID-8482190", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.1.2" } } }, { "category": "product_version_range", "name": "vers:unknown/1.1.3", "product": { "name": "vers:unknown/1.1.3", "product_id": "CSAFPID-8482191", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.1.3" } } }, { "category": "product_version_range", "name": "vers:unknown/1.1.4", "product": { "name": "vers:unknown/1.1.4", "product_id": "CSAFPID-8482192", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.1.4" } } }, { "category": "product_version_range", "name": "vers:unknown/1.1.5", "product": { "name": "vers:unknown/1.1.5", "product_id": "CSAFPID-8482193", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.1.5" } } }, { "category": "product_version_range", "name": "vers:unknown/1.1.6", "product": { "name": "vers:unknown/1.1.6", "product_id": "CSAFPID-8482194", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.1.6" } } }, { "category": "product_version_range", "name": "vers:unknown/1.1.6.pre1", "product": { "name": "vers:unknown/1.1.6.pre1", "product_id": "CSAFPID-8482195", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.1.6.pre1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.1.7", "product": { "name": "vers:unknown/1.1.7", "product_id": "CSAFPID-8482196", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.1.7" } } }, { "category": "product_version_range", "name": "vers:unknown/1.1.8", "product": { "name": "vers:unknown/1.1.8", "product_id": "CSAFPID-8482197", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.1.8" } } }, { "category": "product_version_range", "name": "vers:unknown/1.1.9", "product": { "name": "vers:unknown/1.1.9", "product_id": "CSAFPID-8482198", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.1.9" } } }, { "category": "product_version_range", "name": "vers:unknown/1.2.0", "product": { "name": "vers:unknown/1.2.0", "product_id": "CSAFPID-8482199", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.2.0" } } }, { "category": "product_version_range", "name": "vers:unknown/1.2.1", "product": { "name": "vers:unknown/1.2.1", "product_id": "CSAFPID-8482200", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.2.1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.2.2", "product": { "name": "vers:unknown/1.2.2", "product_id": "CSAFPID-8482201", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.2.2" } } }, { "category": "product_version_range", "name": "vers:unknown/1.2.3", "product": { "name": "vers:unknown/1.2.3", "product_id": "CSAFPID-8482202", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.2.3" } } }, { "category": "product_version_range", "name": "vers:unknown/1.3.1", "product": { "name": "vers:unknown/1.3.1", "product_id": "CSAFPID-8482203", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.3.1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.3.1.pre", "product": { "name": "vers:unknown/1.3.1.pre", "product_id": "CSAFPID-8482204", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.3.1.pre" } } }, { "category": "product_version_range", "name": "vers:unknown/1.3.2", "product": { "name": "vers:unknown/1.3.2", "product_id": "CSAFPID-8482205", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.3.2" } } }, { "category": "product_version_range", "name": "vers:unknown/1.3.3", "product": { "name": "vers:unknown/1.3.3", "product_id": "CSAFPID-8482206", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.3.3" } } }, { "category": "product_version_range", "name": "vers:unknown/1.3.4", "product": { "name": "vers:unknown/1.3.4", "product_id": "CSAFPID-8482207", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.3.4" } } }, { "category": "product_version_range", "name": "vers:unknown/1.3.5", "product": { "name": "vers:unknown/1.3.5", "product_id": "CSAFPID-8482208", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.3.5" } } }, { "category": "product_version_range", "name": "vers:unknown/1.3.6", "product": { "name": "vers:unknown/1.3.6", "product_id": "CSAFPID-8482209", "product_identification_helper": { "purl": "pkg:gem/concurrent-ruby@1.3.6" } } }, { "category": "product_version_range", "name": "vers:unknown/<1.3.7", "product": { "name": "vers:unknown/<1.3.7", "product_id": "CSAFPID-8493290" } }, { "category": "product_version_range", "name": "vers:unknown/>=0|<1.3.7", "product": { "name": "vers:unknown/>=0|<1.3.7", "product_id": "CSAFPID-8482210" } }, { "category": "product_version_range", "name": "vers:unknown/edge-v0.2.3", "product": { "name": "vers:unknown/edge-v0.2.3", "product_id": "CSAFPID-8780010" } }, { "category": "product_version_range", "name": "vers:unknown/edge-v0.3.0", "product": { "name": "vers:unknown/edge-v0.3.0", "product_id": "CSAFPID-8780014" } }, { "category": "product_version_range", "name": "vers:unknown/edge-v0.3.1", "product": { "name": "vers:unknown/edge-v0.3.1", "product_id": "CSAFPID-8780012" } }, { "category": "product_version_range", "name": "vers:unknown/edge-v0.4.0", "product": { "name": "vers:unknown/edge-v0.4.0", "product_id": "CSAFPID-8780004" } }, { "category": "product_version_range", "name": "vers:unknown/edge-v0.4.0.pre1", "product": { "name": "vers:unknown/edge-v0.4.0.pre1", "product_id": "CSAFPID-8780008" } }, { "category": "product_version_range", "name": "vers:unknown/edge-v0.4.0.pre2", "product": { "name": "vers:unknown/edge-v0.4.0.pre2", "product_id": "CSAFPID-8780006" } }, { "category": "product_version_range", "name": "vers:unknown/edge-v0.4.1", "product": { "name": "vers:unknown/edge-v0.4.1", "product_id": "CSAFPID-8780002" } }, { "category": "product_version_range", "name": "vers:unknown/edge-v0.5.0", "product": { "name": "vers:unknown/edge-v0.5.0", "product_id": "CSAFPID-8779997" } }, { "category": "product_version_range", "name": "vers:unknown/edge-v0.6.0", "product": { "name": "vers:unknown/edge-v0.6.0", "product_id": "CSAFPID-8779993" } }, { "category": "product_version_range", "name": "vers:unknown/edge-v0.6.0.pre1", "product": { "name": "vers:unknown/edge-v0.6.0.pre1", "product_id": "CSAFPID-8779995" } }, { "category": "product_version_range", "name": "vers:unknown/edge-v0.7.0", "product": { "name": "vers:unknown/edge-v0.7.0", "product_id": "CSAFPID-8779987" } }, { "category": "product_version_range", "name": "vers:unknown/edge-v0.7.1", "product": { "name": "vers:unknown/edge-v0.7.1", "product_id": "CSAFPID-8779980" } }, { "category": "product_version_range", "name": "vers:unknown/edge-v0.7.2", "product": { "name": "vers:unknown/edge-v0.7.2", "product_id": "CSAFPID-8779976" } }, { "category": "product_version_range", "name": "vers:unknown/v0.0.1", "product": { "name": "vers:unknown/v0.0.1", "product_id": "CSAFPID-8780056" } }, { "category": "product_version_range", "name": "vers:unknown/v0.0.2", "product": { "name": "vers:unknown/v0.0.2", "product_id": "CSAFPID-8780049" } }, { "category": "product_version_range", "name": "vers:unknown/v0.1.0", "product": { "name": "vers:unknown/v0.1.0", "product_id": "CSAFPID-8780055" } }, { "category": "product_version_range", "name": "vers:unknown/v0.1.1.pre.2", "product": { "name": "vers:unknown/v0.1.1.pre.2", "product_id": "CSAFPID-8780054" } }, { "category": "product_version_range", "name": "vers:unknown/v0.1.1.pre.4", "product": { "name": "vers:unknown/v0.1.1.pre.4", "product_id": "CSAFPID-8780053" } }, { "category": "product_version_range", "name": "vers:unknown/v0.1.1.pre.5", "product": { "name": "vers:unknown/v0.1.1.pre.5", "product_id": "CSAFPID-8780052" } }, { "category": "product_version_range", "name": "vers:unknown/v0.2.0", "product": { "name": "vers:unknown/v0.2.0", "product_id": "CSAFPID-8780051" } }, { "category": "product_version_range", "name": "vers:unknown/v0.2.1", "product": { "name": "vers:unknown/v0.2.1", "product_id": "CSAFPID-8780050" } }, { "category": "product_version_range", "name": "vers:unknown/v0.2.2", "product": { "name": "vers:unknown/v0.2.2", "product_id": "CSAFPID-8780048" } }, { "category": "product_version_range", "name": "vers:unknown/v0.3.0", "product": { "name": "vers:unknown/v0.3.0", "product_id": "CSAFPID-8780045" } }, { "category": "product_version_range", "name": "vers:unknown/v0.3.0.pre.2", "product": { "name": "vers:unknown/v0.3.0.pre.2", "product_id": "CSAFPID-8780047" } }, { "category": "product_version_range", "name": "vers:unknown/v0.3.0.pre.3", "product": { "name": "vers:unknown/v0.3.0.pre.3", "product_id": "CSAFPID-8780046" } }, { "category": "product_version_range", "name": "vers:unknown/v0.3.1", "product": { "name": "vers:unknown/v0.3.1", "product_id": "CSAFPID-8780042" } }, { "category": "product_version_range", "name": "vers:unknown/v0.3.1.pre.1", "product": { "name": "vers:unknown/v0.3.1.pre.1", "product_id": "CSAFPID-8780044" } }, { "category": "product_version_range", "name": "vers:unknown/v0.3.1.pre.2", "product": { "name": "vers:unknown/v0.3.1.pre.2", "product_id": "CSAFPID-8780043" } }, { "category": "product_version_range", "name": "vers:unknown/v0.3.2", "product": { "name": "vers:unknown/v0.3.2", "product_id": "CSAFPID-8780041" } }, { "category": "product_version_range", "name": "vers:unknown/v0.4.0", "product": { "name": "vers:unknown/v0.4.0", "product_id": "CSAFPID-8780040" } }, { "category": "product_version_range", "name": "vers:unknown/v0.6.0", "product": { "name": "vers:unknown/v0.6.0", "product_id": "CSAFPID-8780037" } }, { "category": "product_version_range", "name": "vers:unknown/v0.6.0.pre.1", "product": { "name": "vers:unknown/v0.6.0.pre.1", "product_id": "CSAFPID-8780039" } }, { "category": "product_version_range", "name": "vers:unknown/v0.6.0.pre.2", "product": { "name": "vers:unknown/v0.6.0.pre.2", "product_id": "CSAFPID-8780038" } }, { "category": "product_version_range", "name": "vers:unknown/v0.6.1", "product": { "name": "vers:unknown/v0.6.1", "product_id": "CSAFPID-8780036" } }, { "category": "product_version_range", "name": "vers:unknown/v0.7.0", "product": { "name": "vers:unknown/v0.7.0", "product_id": "CSAFPID-8780032" } }, { "category": "product_version_range", "name": "vers:unknown/v0.7.0.1", "product": { "name": "vers:unknown/v0.7.0.1", "product_id": "CSAFPID-8780031" } }, { "category": "product_version_range", "name": "vers:unknown/v0.7.0.rc1", "product": { "name": "vers:unknown/v0.7.0.rc1", "product_id": "CSAFPID-8780035" } }, { "category": "product_version_range", "name": "vers:unknown/v0.7.0.rc2", "product": { "name": "vers:unknown/v0.7.0.rc2", "product_id": "CSAFPID-8780034" } }, { "category": "product_version_range", "name": "vers:unknown/v0.7.0.rc3", "product": { "name": "vers:unknown/v0.7.0.rc3", "product_id": "CSAFPID-8780033" } }, { "category": "product_version_range", "name": "vers:unknown/v0.7.2", "product": { "name": "vers:unknown/v0.7.2", "product_id": "CSAFPID-8780030" } }, { "category": "product_version_range", "name": "vers:unknown/v0.8.0", "product": { "name": "vers:unknown/v0.8.0", "product_id": "CSAFPID-8780029" } }, { "category": "product_version_range", "name": "vers:unknown/v0.9.0", "product": { "name": "vers:unknown/v0.9.0", "product_id": "CSAFPID-8780025" } }, { "category": "product_version_range", "name": "vers:unknown/v0.9.0.pre1", "product": { "name": "vers:unknown/v0.9.0.pre1", "product_id": "CSAFPID-8780028" } }, { "category": "product_version_range", "name": "vers:unknown/v0.9.0.pre2", "product": { "name": "vers:unknown/v0.9.0.pre2", "product_id": "CSAFPID-8780027" } }, { "category": "product_version_range", "name": "vers:unknown/v0.9.0.pre3", "product": { "name": "vers:unknown/v0.9.0.pre3", "product_id": "CSAFPID-8780026" } }, { "category": "product_version_range", "name": "vers:unknown/v0.9.1", "product": { "name": "vers:unknown/v0.9.1", "product_id": "CSAFPID-8780022" } }, { "category": "product_version_range", "name": "vers:unknown/v1.0.0", "product": { "name": "vers:unknown/v1.0.0", "product_id": "CSAFPID-8780020" } }, { "category": "product_version_range", "name": "vers:unknown/v1.0.0.pre1", "product": { "name": "vers:unknown/v1.0.0.pre1", "product_id": "CSAFPID-8780024" } }, { "category": "product_version_range", "name": "vers:unknown/v1.0.0.pre4", "product": { "name": "vers:unknown/v1.0.0.pre4", "product_id": "CSAFPID-8780023" } }, { "category": "product_version_range", "name": "vers:unknown/v1.0.0.pre5", "product": { "name": "vers:unknown/v1.0.0.pre5", "product_id": "CSAFPID-8780021" } }, { "category": "product_version_range", "name": "vers:unknown/v1.0.1", "product": { "name": "vers:unknown/v1.0.1", "product_id": "CSAFPID-8780019" } }, { "category": "product_version_range", "name": "vers:unknown/v1.0.2", "product": { "name": "vers:unknown/v1.0.2", "product_id": "CSAFPID-8780018" } }, { "category": "product_version_range", "name": "vers:unknown/v1.0.3", "product": { "name": "vers:unknown/v1.0.3", "product_id": "CSAFPID-8780009" } }, { "category": "product_version_range", "name": "vers:unknown/v1.0.3.pre1", "product": { "name": "vers:unknown/v1.0.3.pre1", "product_id": "CSAFPID-8780017" } }, { "category": "product_version_range", "name": "vers:unknown/v1.0.3.pre2", "product": { "name": "vers:unknown/v1.0.3.pre2", "product_id": "CSAFPID-8780016" } }, { "category": "product_version_range", "name": "vers:unknown/v1.0.3.pre3", "product": { "name": "vers:unknown/v1.0.3.pre3", "product_id": "CSAFPID-8780015" } }, { "category": "product_version_range", "name": "vers:unknown/v1.0.4", "product": { "name": "vers:unknown/v1.0.4", "product_id": "CSAFPID-8780013" } }, { "category": "product_version_range", "name": "vers:unknown/v1.0.5", "product": { "name": "vers:unknown/v1.0.5", "product_id": "CSAFPID-8780011" } }, { "category": "product_version_range", "name": "vers:unknown/v1.1.0", "product": { "name": "vers:unknown/v1.1.0", "product_id": "CSAFPID-8780003" } }, { "category": "product_version_range", "name": "vers:unknown/v1.1.0.pre1", "product": { "name": "vers:unknown/v1.1.0.pre1", "product_id": "CSAFPID-8780007" } }, { "category": "product_version_range", "name": "vers:unknown/v1.1.0.pre2", "product": { "name": "vers:unknown/v1.1.0.pre2", "product_id": "CSAFPID-8780005" } }, { "category": "product_version_range", "name": "vers:unknown/v1.1.1", "product": { "name": "vers:unknown/v1.1.1", "product_id": "CSAFPID-8780001" } }, { "category": "product_version_range", "name": "vers:unknown/v1.1.2", "product": { "name": "vers:unknown/v1.1.2", "product_id": "CSAFPID-8780000" } }, { "category": "product_version_range", "name": "vers:unknown/v1.1.3", "product": { "name": "vers:unknown/v1.1.3", "product_id": "CSAFPID-8779999" } }, { "category": "product_version_range", "name": "vers:unknown/v1.1.4", "product": { "name": "vers:unknown/v1.1.4", "product_id": "CSAFPID-8779998" } }, { "category": "product_version_range", "name": "vers:unknown/v1.1.5", "product": { "name": "vers:unknown/v1.1.5", "product_id": "CSAFPID-8779996" } }, { "category": "product_version_range", "name": "vers:unknown/v1.1.6", "product": { "name": "vers:unknown/v1.1.6", "product_id": "CSAFPID-8779992" } }, { "category": "product_version_range", "name": "vers:unknown/v1.1.6.pre1", "product": { "name": "vers:unknown/v1.1.6.pre1", "product_id": "CSAFPID-8779994" } }, { "category": "product_version_range", "name": "vers:unknown/v1.1.7", "product": { "name": "vers:unknown/v1.1.7", "product_id": "CSAFPID-8779991" } }, { "category": "product_version_range", "name": "vers:unknown/v1.1.8", "product": { "name": "vers:unknown/v1.1.8", "product_id": "CSAFPID-8779990" } }, { "category": "product_version_range", "name": "vers:unknown/v1.1.9", "product": { "name": "vers:unknown/v1.1.9", "product_id": "CSAFPID-8779989" } }, { "category": "product_version_range", "name": "vers:unknown/v1.2.0", "product": { "name": "vers:unknown/v1.2.0", "product_id": "CSAFPID-8779988" } }, { "category": "product_version_range", "name": "vers:unknown/v1.2.1", "product": { "name": "vers:unknown/v1.2.1", "product_id": "CSAFPID-8779986" } }, { "category": "product_version_range", "name": "vers:unknown/v1.2.2", "product": { "name": "vers:unknown/v1.2.2", "product_id": "CSAFPID-8779985" } }, { "category": "product_version_range", "name": "vers:unknown/v1.2.3", "product": { "name": "vers:unknown/v1.2.3", "product_id": "CSAFPID-8779984" } }, { "category": "product_version_range", "name": "vers:unknown/v1.3.0", "product": { "name": "vers:unknown/v1.3.0", "product_id": "CSAFPID-8779983" } }, { "category": "product_version_range", "name": "vers:unknown/v1.3.1", "product": { "name": "vers:unknown/v1.3.1", "product_id": "CSAFPID-8779981" } }, { "category": "product_version_range", "name": "vers:unknown/v1.3.1.pre", "product": { "name": "vers:unknown/v1.3.1.pre", "product_id": "CSAFPID-8779982" } }, { "category": "product_version_range", "name": "vers:unknown/v1.3.2", "product": { "name": "vers:unknown/v1.3.2", "product_id": "CSAFPID-8779979" } }, { "category": "product_version_range", "name": "vers:unknown/v1.3.3", "product": { "name": "vers:unknown/v1.3.3", "product_id": "CSAFPID-8779978" } }, { "category": "product_version_range", "name": "vers:unknown/v1.3.4", "product": { "name": "vers:unknown/v1.3.4", "product_id": "CSAFPID-8779977" } }, { "category": "product_version_range", "name": "vers:unknown/v1.3.5", "product": { "name": "vers:unknown/v1.3.5", "product_id": "CSAFPID-8779975" } }, { "category": "product_version_range", "name": "vers:unknown/v1.3.6", "product": { "name": "vers:unknown/v1.3.6", "product_id": "CSAFPID-8779974" } } ], "category": "product_name", "name": "concurrent-ruby" } ], "category": "vendor", "name": "ruby-concurrency" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<1.3.7", "product": { "name": "vers:unknown/<1.3.7", "product_id": "CSAFPID-8505127", "product_identification_helper": { "cpe": "cpe:2.3:a:rubyconcurrency:concurrent_ruby:*:*:*:*:*:ruby:*:*" } } } ], "category": "product_name", "name": "concurrent_ruby" } ], "category": "vendor", "name": "rubyconcurrency" }, { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:deb/unknown", "product": { "name": "vers:deb/unknown", "product_id": "CSAFPID-8496152" } } ], "category": "product_name", "name": "ruby-concurrent" } ], "category": "product_family", "name": "bookworm" } ], "category": "vendor", "name": "debian" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-54906", "cwe": { "id": "CWE-414", "name": "Missing Lock Check" }, "notes": [ { "category": "description", "text": "concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReadWriteLock#release_write_lock does not verify that the calling thread acquired the write lock. Any thread with access to the lock object can release an active write lock held by another thread. A second writer can then enter its critical section while the first writer is still running. Concurrent::ReadWriteLock#release_read_lock also decrements the shared counter even when no read lock is held. Calling it on a fresh lock changes the counter from 0 to -1, after which normal read acquisition raises Concurrent::ResourceLimitError. This is a synchronization correctness issue in the public Concurrent::ReadWriteLock API. This vulnerability is fixed in 1.3.7.", "title": "osvgit - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-54906.json?alt=media" }, { "category": "description", "text": "### Summary\n`Concurrent::ReadWriteLock#release_write_lock` does not verify that the calling thread acquired the write lock. Any thread with access to the lock object can release an active write lock held by another thread. A second writer can then enter its critical section while the first writer is still running.\n\n`Concurrent::ReadWriteLock#release_read_lock` also decrements the shared counter even when no read lock is held. Calling it on a fresh lock changes the counter from `0` to `-1`, after which normal read acquisition raises `Concurrent::ResourceLimitError`.\n\nThis is a synchronization correctness issue in the public `Concurrent::ReadWriteLock` API. It should not be framed as an authorization bypass; the lock is an in-process concurrency primitive, not an access-control boundary.\n\n### Version\nSoftware: concurrent-ruby\nVersion: 1.3.6\nCommit: 7a1b78941c081106c20a9ca0144ac73a48d254ab\n\n### Details\n\n`release_write_lock` checks only whether the global counter indicates that a writer is running. It does not track or verify ownership:\n\n```ruby\ndef release_write_lock\n return true unless running_writer?\n c = @Counter.update { |counter| counter - RUNNING_WRITER }\n @ReadLock.broadcast\n @WriteLock.signal if waiting_writers(c) > 0\n true\nend\n```\n\nBecause ownership is not checked, a different thread can clear the `RUNNING_WRITER` bit while the original writer is still inside its critical section. Another writer can then acquire the write lock and run concurrently with the first writer.\n\n`release_read_lock` unconditionally decrements the shared counter:\n\n```ruby\ndef release_read_lock\n while true\n c = @Counter.value\n if @Counter.compare_and_set(c, c-1)\n if waiting_writer?(c) && running_readers(c) == 1\n @WriteLock.signal\n end\n break\n end\n end\n true\nend\n```\n\nOn a fresh lock, this changes the counter from `0` to `-1`. A later `acquire_read_lock` raises `Concurrent::ResourceLimitError` because the maximum-reader check masks the negative counter as saturated.\n\n# Reproduce\n\nFrom the root of a `concurrent-ruby` checkout, run:\n\n```bash\nruby -Ilib/concurrent-ruby - <<'RUBY'\nrequire 'concurrent/atomic/read_write_lock'\nrequire 'concurrent/version'\nrequire 'thread'\n\nputs \"ruby=#{RUBY_DESCRIPTION}\"\nputs \"concurrent_ruby_version=#{Concurrent::VERSION}\"\nputs \"poc=ReadWriteLock release methods corrupt or bypass lock state\"\n\nlock = Concurrent::ReadWriteLock.new\nevents = Queue.new\nwriter1_inside = false\n\nwriter1 = Thread.new do\n lock.acquire_write_lock\n writer1_inside = true\n events << :writer1_acquired\n sleep 0.5\n writer1_inside = false\n lock.release_write_lock\n events << :writer1_finished\nend\n\nevents.pop\nputs 'writer1_acquired=true'\n\nintruder_result = nil\nintruder = Thread.new do\n intruder_result = lock.release_write_lock\nend\nintruder.join\n\nputs \"wrong_thread_release_write_lock_returned=#{intruder_result}\"\n\nwriter2_entered_while_writer1_inside = nil\nwriter2 = Thread.new do\n lock.acquire_write_lock\n writer2_entered_while_writer1_inside = writer1_inside\n lock.release_write_lock\nend\n\nwriter2.join(0.25)\n\nputs \"writer2_acquired_while_writer1_inside=#{writer2_entered_while_writer1_inside}\"\n\nwriter1.join\n\nlock2 = Concurrent::ReadWriteLock.new\nstray_read_release_result = lock2.release_read_lock\ncounter_after_stray_read_release = lock2.instance_eval { @Counter.value }\nread_after_stray_release = begin\n lock2.acquire_read_lock\n 'acquired'\nrescue => error\n \"#{error.class}: #{error.message}\"\nend\n\nputs \"stray_release_read_lock_returned=#{stray_read_release_result}\"\nputs \"counter_after_stray_read_release=#{counter_after_stray_read_release}\"\nputs \"acquire_read_after_stray_release=#{read_after_stray_release}\"\n\nif intruder_result && writer2_entered_while_writer1_inside && counter_after_stray_read_release == -1\n puts 'result=REPRODUCED wrong-thread write release and stray read-release corruption'\nelse\n puts 'result=NOT_REPRODUCED'\nend\n```\nExpected result:\n\n- A second thread successfully calls `release_write_lock` while the first writer still holds the lock.\n- A second writer enters while the first writer is still inside the write critical section.\n- Calling `release_read_lock` on a fresh lock changes the counter to `-1`.\n- A subsequent read acquisition fails with `Concurrent::ResourceLimitError`.\n\n### Log evidence\n\nLocal reproduction output:\n\n```text\nruby=ruby 2.6.10p210 (2022-04-12 revision 67958) [universal.arm64e-darwin25]\nconcurrent_ruby_version=1.3.6\npoc=ReadWriteLock release methods corrupt or bypass lock state\nwriter1_acquired=true\nwrong_thread_release_write_lock_returned=true\nwriter2_acquired_while_writer1_inside=true\nstray_release_read_lock_returned=true\ncounter_after_stray_read_release=-1\nacquire_read_after_stray_release=Concurrent::ResourceLimitError: Too many reader threads\nresult=REPRODUCED wrong-thread write release and stray read-release corruption\n```\n\n### Impact\nThis can break the write-lock mutual exclusion guarantee and can also leave a lock unusable after a stray read release.\nThe impact is local to applications that expose or misuse the manual `acquire_*` / `release_*` APIs. If the lock protects integrity-sensitive mutable state, wrong-thread write release can allow concurrent writers and data races. The stray read-release path can cause denial of service by corrupting the lock counter.\n\n### Credit\nPranjali Thakur - depthfirst ([depthfirst.com]())", "title": "github - https://api.github.com/advisories/GHSA-6wx8-w4f5-wwcr" }, { "category": "description", "text": "concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReadWriteLock#release_write_lock does not verify that the calling thread acquired the write lock. Any thread with access to the lock object can release an active write lock held by another thread. A second writer can then enter its critical section while the first writer is still running. Concurrent::ReadWriteLock#release_read_lock also decrements the shared counter even when no read lock is held. Calling it on a fresh lock changes the counter from 0 to -1, after which normal read acquisition raises Concurrent::ResourceLimitError. This is a synchronization correctness issue in the public Concurrent::ReadWriteLock API. This vulnerability is fixed in 1.3.7.", "title": "nvd - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-54906" }, { "category": "description", "text": "A flaw was found in concurrent-ruby, a Ruby library for managing concurrent operations. The `Concurrent::ReadWriteLock` component contains a synchronization issue where write locks can be released by unauthorized threads. This could allow multiple threads to write concurrently, potentially leading to data corruption. Furthermore, an issue with read lock management can cause a denial of service (DoS) by preventing legitimate read operations.\nThis is essentially a library misuse scenario. The attack requires local code execution in the same Ruby process AND use of the manual locking API (ReadWriteLock). Most applications use Concurrent::Future, Concurrent::Promise, Concurrent::Promises, Concurrent::Array/Hash, and Concurrent::Atom — not the low-level ReadWriteLock.", "title": "redhat - https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-54906.json" }, { "category": "description", "text": "concurrent-ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruption", "title": "microsoft - https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Jun" }, { "category": "description", "text": "`Concurrent::ReadWriteLock#release_write_lock` does not verify that the calling thread acquired the write lock. Any thread with access to the lock object can release an active write lock held by another thread. A second writer can then enter its critical section while the first writer is still running.\n\n`Concurrent::ReadWriteLock#release_read_lock` also decrements the shared counter even when no read lock is held. Calling it on a fresh lock changes the counter from `0` to `-1`, after which normal read acquisition raises `Concurrent::ResourceLimitError`.\n\nThis is a synchronization correctness issue in the public `Concurrent::ReadWriteLock` API. It should not be framed as an authorization bypass; the lock is an in-process concurrency primitive, not an access-control boundary.", "title": "gitlab - https://gitlab.com/api/v4/projects/25847700/repository/files/gem%2Fconcurrent-ruby%2FCVE-2026-54906.yml/raw" }, { "category": "description", "text": "concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReadWriteLock#release_write_lock does not verify that the calling thread acquired the write lock. Any thread with access to the lock object can release an active write lock held by another thread. A second writer can then enter its critical section while the first writer is still running. Concurrent::ReadWriteLock#release_read_lock also decrements the shared counter even when no read lock is held. Calling it on a fresh lock changes the counter from 0 to -1, after which normal read acquisition raises Concurrent::ResourceLimitError. This is a synchronization correctness issue in the public Concurrent::ReadWriteLock API. This vulnerability is fixed in 1.3.7.", "title": "debian - https://security-tracker.debian.org/tracker/CVE-2026-54906" }, { "category": "description", "text": "### Summary\n`Concurrent::ReadWriteLock#release_write_lock` does not verify that the calling thread acquired the write lock. Any thread with access to the lock object can release an active write lock held by another thread. A second writer can then enter its critical section while the first writer is still running.\n\n`Concurrent::ReadWriteLock#release_read_lock` also decrements the shared counter even when no read lock is held. Calling it on a fresh lock changes the counter from `0` to `-1`, after which normal read acquisition raises `Concurrent::ResourceLimitError`.\n\nThis is a synchronization correctness issue in the public `Concurrent::ReadWriteLock` API. It should not be framed as an authorization bypass; the lock is an in-process concurrency primitive, not an access-control boundary.\n\n### Version\nSoftware: concurrent-ruby\nVersion: 1.3.6\nCommit: 7a1b78941c081106c20a9ca0144ac73a48d254ab\n\n### Details\n\n`release_write_lock` checks only whether the global counter indicates that a writer is running. It does not track or verify ownership:\n\n```ruby\ndef release_write_lock\n return true unless running_writer?\n c = @Counter.update { |counter| counter - RUNNING_WRITER }\n @ReadLock.broadcast\n @WriteLock.signal if waiting_writers(c) > 0\n true\nend\n```\n\nBecause ownership is not checked, a different thread can clear the `RUNNING_WRITER` bit while the original writer is still inside its critical section. Another writer can then acquire the write lock and run concurrently with the first writer.\n\n`release_read_lock` unconditionally decrements the shared counter:\n\n```ruby\ndef release_read_lock\n while true\n c = @Counter.value\n if @Counter.compare_and_set(c, c-1)\n if waiting_writer?(c) && running_readers(c) == 1\n @WriteLock.signal\n end\n break\n end\n end\n true\nend\n```\n\nOn a fresh lock, this changes the counter from `0` to `-1`. A later `acquire_read_lock` raises `Concurrent::ResourceLimitError` because the maximum-reader check masks the negative counter as saturated.\n\n# Reproduce\n\nFrom the root of a `concurrent-ruby` checkout, run:\n\n```bash\nruby -Ilib/concurrent-ruby - <<'RUBY'\nrequire 'concurrent/atomic/read_write_lock'\nrequire 'concurrent/version'\nrequire 'thread'\n\nputs \"ruby=#{RUBY_DESCRIPTION}\"\nputs \"concurrent_ruby_version=#{Concurrent::VERSION}\"\nputs \"poc=ReadWriteLock release methods corrupt or bypass lock state\"\n\nlock = Concurrent::ReadWriteLock.new\nevents = Queue.new\nwriter1_inside = false\n\nwriter1 = Thread.new do\n lock.acquire_write_lock\n writer1_inside = true\n events << :writer1_acquired\n sleep 0.5\n writer1_inside = false\n lock.release_write_lock\n events << :writer1_finished\nend\n\nevents.pop\nputs 'writer1_acquired=true'\n\nintruder_result = nil\nintruder = Thread.new do\n intruder_result = lock.release_write_lock\nend\nintruder.join\n\nputs \"wrong_thread_release_write_lock_returned=#{intruder_result}\"\n\nwriter2_entered_while_writer1_inside = nil\nwriter2 = Thread.new do\n lock.acquire_write_lock\n writer2_entered_while_writer1_inside = writer1_inside\n lock.release_write_lock\nend\n\nwriter2.join(0.25)\n\nputs \"writer2_acquired_while_writer1_inside=#{writer2_entered_while_writer1_inside}\"\n\nwriter1.join\n\nlock2 = Concurrent::ReadWriteLock.new\nstray_read_release_result = lock2.release_read_lock\ncounter_after_stray_read_release = lock2.instance_eval { @Counter.value }\nread_after_stray_release = begin\n lock2.acquire_read_lock\n 'acquired'\nrescue => error\n \"#{error.class}: #{error.message}\"\nend\n\nputs \"stray_release_read_lock_returned=#{stray_read_release_result}\"\nputs \"counter_after_stray_read_release=#{counter_after_stray_read_release}\"\nputs \"acquire_read_after_stray_release=#{read_after_stray_release}\"\n\nif intruder_result && writer2_entered_while_writer1_inside && counter_after_stray_read_release == -1\n puts 'result=REPRODUCED wrong-thread write release and stray read-release corruption'\nelse\n puts 'result=NOT_REPRODUCED'\nend\n```\nExpected result:\n\n- A second thread successfully calls `release_write_lock` while the first writer still holds the lock.\n- A second writer enters while the first writer is still inside the write critical section.\n- Calling `release_read_lock` on a fresh lock changes the counter to `-1`.\n- A subsequent read acquisition fails with `Concurrent::ResourceLimitError`.\n\n### Log evidence\n\nLocal reproduction output:\n\n```text\nruby=ruby 2.6.10p210 (2022-04-12 revision 67958) [universal.arm64e-darwin25]\nconcurrent_ruby_version=1.3.6\npoc=ReadWriteLock release methods corrupt or bypass lock state\nwriter1_acquired=true\nwrong_thread_release_write_lock_returned=true\nwriter2_acquired_while_writer1_inside=true\nstray_release_read_lock_returned=true\ncounter_after_stray_read_release=-1\nacquire_read_after_stray_release=Concurrent::ResourceLimitError: Too many reader threads\nresult=REPRODUCED wrong-thread write release and stray read-release corruption\n```\n\n### Impact\nThis can break the write-lock mutual exclusion guarantee and can also leave a lock unusable after a stray read release.\nThe impact is local to applications that expose or misuse the manual `acquire_*` / `release_*` APIs. If the lock protects integrity-sensitive mutable state, wrong-thread write release can allow concurrent writers and data races. The stray read-release path can cause denial of service by corrupting the lock counter.\n\n### Credit\nPranjali Thakur - depthfirst ([depthfirst.com]())", "title": "osvrubygems - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/RubyGems%2FGHSA-6wx8-w4f5-wwcr.json?alt=media" }, { "category": "description", "text": "Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI (Ruby)). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in takeover of Siebel CRM End User. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).", "title": "oracle - https://www.oracle.com/a/tech/docs/security-alerts/cpuoct2026csaf.json" }, { "category": "description", "text": "concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReadWriteLock#release_write_lock does not verify that the calling thread acquired the write lock. Any thread with access to the lock object can release an active write lock held by another thread. A second writer can then enter its critical section while the first writer is still running. Concurrent::ReadWriteLock#release_read_lock also decrements the shared counter even when no read lock is held. Calling it on a fresh lock changes the counter from 0 to -1, after which normal read acquisition raises Concurrent::ResourceLimitError. This is a synchronization correctness issue in the public Concurrent::ReadWriteLock API. This vulnerability is fixed in 1.3.7.", "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-54906" }, { "category": "other", "text": "0.00252", "title": "EPSS" }, { "category": "other", "text": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" }, { "category": "other", "text": "2.1", "title": "CVSSV4 base score" }, { "category": "other", "text": "4.9", "title": "NCSC Score" }, { "category": "other", "text": "There is product data available from source Certbundde, VENDOR FIX as product remediation category, There is product data available from source Oracle", "title": "NCSC Score top increasing factors" }, { "category": "other", "text": "Is related to (a version of) an uncommon product, Is related to a product by vendor Debian", "title": "NCSC Score top decreasing factors" }, { "category": "details", "text": "Severity: 1\n", "title": "Vendor assessment" } ], "product_status": { "known_affected": [ "CSAFPID-8496152", "CSAFPID-8505127", "CSAFPID-8493290", "CSAFPID-8482145", "CSAFPID-8482176", "CSAFPID-8482177", "CSAFPID-8780010", "CSAFPID-8780014", "CSAFPID-8780012", "CSAFPID-8780004", "CSAFPID-8780008", "CSAFPID-8780006", "CSAFPID-8780002", "CSAFPID-8779997", "CSAFPID-8779993", "CSAFPID-8779995", "CSAFPID-8779987", "CSAFPID-8779980", "CSAFPID-8779976", "CSAFPID-8780056", "CSAFPID-8780049", "CSAFPID-8780055", "CSAFPID-8780054", "CSAFPID-8780053", "CSAFPID-8780052", "CSAFPID-8780051", "CSAFPID-8780050", "CSAFPID-8780048", "CSAFPID-8780045", "CSAFPID-8780047", "CSAFPID-8780046", "CSAFPID-8780042", "CSAFPID-8780044", "CSAFPID-8780043", "CSAFPID-8780041", "CSAFPID-8780040", "CSAFPID-8780037", "CSAFPID-8780039", "CSAFPID-8780038", "CSAFPID-8780036", "CSAFPID-8780032", "CSAFPID-8780031", "CSAFPID-8780035", "CSAFPID-8780034", "CSAFPID-8780033", "CSAFPID-8780030", "CSAFPID-8780029", "CSAFPID-8780025", "CSAFPID-8780028", "CSAFPID-8780027", "CSAFPID-8780026", "CSAFPID-8780022", "CSAFPID-8780020", "CSAFPID-8780024", "CSAFPID-8780023", "CSAFPID-8780021", "CSAFPID-8780019", "CSAFPID-8780018", "CSAFPID-8780009", "CSAFPID-8780017", "CSAFPID-8780016", "CSAFPID-8780015", "CSAFPID-8780013", "CSAFPID-8780011", "CSAFPID-8780003", "CSAFPID-8780007", "CSAFPID-8780005", "CSAFPID-8780001", "CSAFPID-8780000", "CSAFPID-8779999", "CSAFPID-8779998", "CSAFPID-8779996", "CSAFPID-8779992", "CSAFPID-8779994", "CSAFPID-8779991", "CSAFPID-8779990", "CSAFPID-8779989", "CSAFPID-8779988", "CSAFPID-8779986", "CSAFPID-8779985", "CSAFPID-8779984", "CSAFPID-8779983", "CSAFPID-8779981", "CSAFPID-8779982", "CSAFPID-8779979", "CSAFPID-8779978", "CSAFPID-8779977", "CSAFPID-8779975", "CSAFPID-8779974", "CSAFPID-8482133", "CSAFPID-8482134", "CSAFPID-8482135", "CSAFPID-8482136", "CSAFPID-8482137", "CSAFPID-8482138", "CSAFPID-8482139", "CSAFPID-8482140", "CSAFPID-8482141", "CSAFPID-8482142", "CSAFPID-8482143", "CSAFPID-8482144", "CSAFPID-8482146", "CSAFPID-8482147", "CSAFPID-8482148", "CSAFPID-8482149", "CSAFPID-8482150", "CSAFPID-8482151", "CSAFPID-8482152", "CSAFPID-8482153", "CSAFPID-8482154", "CSAFPID-8482155", "CSAFPID-8482156", "CSAFPID-8482157", "CSAFPID-8482158", "CSAFPID-8482159", "CSAFPID-8482160", "CSAFPID-8482161", "CSAFPID-8482162", "CSAFPID-8482163", "CSAFPID-8482164", "CSAFPID-8482165", "CSAFPID-8482166", "CSAFPID-8482167", "CSAFPID-8482168", "CSAFPID-8482169", "CSAFPID-8482170", "CSAFPID-8482171", "CSAFPID-8482172", "CSAFPID-8482173", "CSAFPID-8482174", "CSAFPID-8482175", "CSAFPID-8482178", "CSAFPID-8482179", "CSAFPID-8482180", "CSAFPID-8482181", "CSAFPID-8482182", "CSAFPID-8482183", "CSAFPID-8482184", "CSAFPID-8482185", "CSAFPID-8482186", "CSAFPID-8482187", "CSAFPID-8482188", "CSAFPID-8482189", "CSAFPID-8482190", "CSAFPID-8482191", "CSAFPID-8482192", "CSAFPID-8482193", "CSAFPID-8482194", "CSAFPID-8482195", "CSAFPID-8482196", "CSAFPID-8482197", "CSAFPID-8482198", "CSAFPID-8482199", "CSAFPID-8482200", "CSAFPID-8482201", "CSAFPID-8482202", "CSAFPID-8482203", "CSAFPID-8482204", "CSAFPID-8482205", "CSAFPID-8482206", "CSAFPID-8482207", "CSAFPID-8482208", "CSAFPID-8482209", "CSAFPID-8482210", "CSAFPID-6212729", "CSAFPID-9763668", "CSAFPID-1350134", "CSAFPID-1846967", "CSAFPID-2726924", "CSAFPID-5129855", "CSAFPID-5129856", "CSAFPID-5452523", "CSAFPID-5452527", "CSAFPID-5452528", "CSAFPID-5452530", "CSAFPID-5452531", "CSAFPID-5452533", "CSAFPID-5452536", "CSAFPID-6213342", "CSAFPID-6213344", "CSAFPID-6213349", "CSAFPID-8469661", "CSAFPID-9010916", "CSAFPID-9010919", "CSAFPID-9794251", "CSAFPID-9794252", "CSAFPID-9794253", "CSAFPID-9794254", "CSAFPID-9794255", "CSAFPID-9794256", "CSAFPID-9794257", "CSAFPID-9794258", "CSAFPID-9794259", "CSAFPID-9794260", "CSAFPID-9794323", "CSAFPID-9794324", "CSAFPID-9794325" ], "known_not_affected": [ "CSAFPID-1439310", "CSAFPID-1439313", "CSAFPID-1441193", "CSAFPID-2821639", "CSAFPID-2821640", "CSAFPID-5011661", "CSAFPID-5360337", "CSAFPID-5360339", "CSAFPID-5360342", "CSAFPID-5360344", "CSAFPID-5499196", "CSAFPID-5499198", "CSAFPID-6009840", "CSAFPID-6009841", "CSAFPID-6009842", "CSAFPID-8502064", "CSAFPID-8502065" ] }, "references": [ { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-54906.json?alt=media" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss" }, { "category": "external", "summary": "Source - github", "url": "https://api.github.com/advisories/GHSA-6wx8-w4f5-wwcr" }, { "category": "external", "summary": "Source - nvd", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-54906" }, { "category": "external", "summary": "Source - debian", "url": "https://security-tracker.debian.org/tracker/CVE-2026-54906" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-54906.json" }, { "category": "external", "summary": "Source - microsoft", "url": "https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Jun" }, { "category": "external", "summary": "Source - gitlab", "url": "https://gitlab.com/api/v4/projects/25847700/repository/files/gem%2Fconcurrent-ruby%2FCVE-2026-54906.yml/raw" }, { "category": "external", "summary": "Source - ncscclear", "url": "https://vulnerabilities.ncsc.nl/manual/CVE-2026-54906" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54906" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/RubyGems%2FGHSA-6wx8-w4f5-wwcr.json?alt=media" }, { "category": "external", "summary": "Source - oracle", "url": "https://www.oracle.com/a/tech/docs/security-alerts/cpuoct2026csaf.json" }, { "category": "external", "summary": "Source - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-4090.json" }, { "category": "external", "summary": "Source - ncscclear", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0444" }, { "category": "external", "summary": "Source - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-4084.json" }, { "category": "external", "summary": "Reference - cveprojectv5; github; gitlab; nvd; osv; redhat", "url": "https://github.com/ruby-concurrency/concurrent-ruby/security/advisories/GHSA-6wx8-w4f5-wwcr" }, { "category": "external", "summary": "Reference - github; gitlab", "url": "https://github.com/advisories/GHSA-6wx8-w4f5-wwcr" }, { "category": "external", "summary": "Reference - redhat", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54906" }, { "category": "external", "summary": "Reference - gitlab; osv; redhat", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54906" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54906.json" }, { "category": "external", "summary": "Reference - oracle", "url": "https://www.oracle.com/security-alerts/cpuoct2026.html" }, { "category": "external", "summary": "Reference - oracle", "url": "https://www.oracle.com/docs/tech/security-alerts/cpuoct2026csaf.json" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-4090.json" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4090" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.oracle.com/security-alerts/cpuoct2026.html#AppendixCGBU" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-4084.json" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4084" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.oracle.com/security-alerts/cpuoct2026.html#AppendixSECR" } ], "remediations": [ { "category": "mitigation", "details": "The concurrent-ruby package ships `Concurrent::ReadWriteLock`, which contains a synchronization flaw allowing concurrent readers and writers under high-contention workloads.\nUpdating to concurrent-ruby version 1.3.5 or later resolves this issue.", "product_ids": [ "CSAFPID-1439310", "CSAFPID-1439313", "CSAFPID-1441193", "CSAFPID-2821639", "CSAFPID-2821640", "CSAFPID-5011661", "CSAFPID-5360337", "CSAFPID-5360339", "CSAFPID-5360342", "CSAFPID-5360344", "CSAFPID-5499196", "CSAFPID-5499198", "CSAFPID-6009840", "CSAFPID-6009841", "CSAFPID-6009842", "CSAFPID-8502064", "CSAFPID-8502065" ] }, { "category": "vendor_fix", "details": "Oracle customers with valid support contracts", "product_ids": [ "CSAFPID-6212729" ], "url": "https://support.oracle.com/support/?documentId=CPU362" }, { "category": "vendor_fix", "details": "Oracle customers with valid support contracts", "product_ids": [ "CSAFPID-9763668" ], "url": "https://support.oracle.com/support/?documentId=CPU419" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1350134", "CSAFPID-1846967", "CSAFPID-2726924", "CSAFPID-5129855", "CSAFPID-5129856", "CSAFPID-5452523", "CSAFPID-5452527", "CSAFPID-5452528", "CSAFPID-5452530", "CSAFPID-5452531", "CSAFPID-5452533", "CSAFPID-5452536", "CSAFPID-6212729", "CSAFPID-6213342", "CSAFPID-6213344", "CSAFPID-6213349", "CSAFPID-8469661", "CSAFPID-8482133", "CSAFPID-8482134", "CSAFPID-8482135", "CSAFPID-8482136", "CSAFPID-8482137", "CSAFPID-8482138", "CSAFPID-8482139", "CSAFPID-8482140", "CSAFPID-8482141", "CSAFPID-8482142", "CSAFPID-8482143", "CSAFPID-8482144", "CSAFPID-8482145", "CSAFPID-8482146", "CSAFPID-8482147", "CSAFPID-8482148", "CSAFPID-8482149", "CSAFPID-8482150", "CSAFPID-8482151", "CSAFPID-8482152", "CSAFPID-8482153", "CSAFPID-8482154", "CSAFPID-8482155", "CSAFPID-8482156", "CSAFPID-8482157", "CSAFPID-8482158", "CSAFPID-8482159", "CSAFPID-8482160", "CSAFPID-8482161", "CSAFPID-8482162", "CSAFPID-8482163", "CSAFPID-8482164", "CSAFPID-8482165", "CSAFPID-8482166", "CSAFPID-8482167", "CSAFPID-8482168", "CSAFPID-8482169", "CSAFPID-8482170", "CSAFPID-8482171", "CSAFPID-8482172", "CSAFPID-8482173", "CSAFPID-8482174", "CSAFPID-8482175", "CSAFPID-8482176", "CSAFPID-8482177", "CSAFPID-8482178", "CSAFPID-8482179", "CSAFPID-8482180", "CSAFPID-8482181", "CSAFPID-8482182", "CSAFPID-8482183", "CSAFPID-8482184", "CSAFPID-8482185", "CSAFPID-8482186", "CSAFPID-8482187", "CSAFPID-8482188", "CSAFPID-8482189", "CSAFPID-8482190", "CSAFPID-8482191", "CSAFPID-8482192", "CSAFPID-8482193", "CSAFPID-8482194", "CSAFPID-8482195", "CSAFPID-8482196", "CSAFPID-8482197", "CSAFPID-8482198", "CSAFPID-8482199", "CSAFPID-8482200", "CSAFPID-8482201", "CSAFPID-8482202", "CSAFPID-8482203", "CSAFPID-8482204", "CSAFPID-8482205", "CSAFPID-8482206", "CSAFPID-8482207", "CSAFPID-8482208", "CSAFPID-8482209", "CSAFPID-8482210", "CSAFPID-8493290", "CSAFPID-8496152", "CSAFPID-8505127", "CSAFPID-8779974", "CSAFPID-8779975", "CSAFPID-8779976", "CSAFPID-8779977", "CSAFPID-8779978", "CSAFPID-8779979", "CSAFPID-8779980", "CSAFPID-8779981", "CSAFPID-8779982", "CSAFPID-8779983", "CSAFPID-8779984", "CSAFPID-8779985", "CSAFPID-8779986", "CSAFPID-8779987", "CSAFPID-8779988", "CSAFPID-8779989", "CSAFPID-8779990", "CSAFPID-8779991", "CSAFPID-8779992", "CSAFPID-8779993", "CSAFPID-8779994", "CSAFPID-8779995", "CSAFPID-8779996", "CSAFPID-8779997", "CSAFPID-8779998", "CSAFPID-8779999", "CSAFPID-8780000", "CSAFPID-8780001", "CSAFPID-8780002", "CSAFPID-8780003", "CSAFPID-8780004", "CSAFPID-8780005", "CSAFPID-8780006", "CSAFPID-8780007", "CSAFPID-8780008", "CSAFPID-8780009", "CSAFPID-8780010", "CSAFPID-8780011", "CSAFPID-8780012", "CSAFPID-8780013", "CSAFPID-8780014", "CSAFPID-8780015", "CSAFPID-8780016", "CSAFPID-8780017", "CSAFPID-8780018", "CSAFPID-8780019", "CSAFPID-8780020", "CSAFPID-8780021", "CSAFPID-8780022", "CSAFPID-8780023", "CSAFPID-8780024", "CSAFPID-8780025", "CSAFPID-8780026", "CSAFPID-8780027", "CSAFPID-8780028", "CSAFPID-8780029", "CSAFPID-8780030", "CSAFPID-8780031", "CSAFPID-8780032", "CSAFPID-8780033", "CSAFPID-8780034", "CSAFPID-8780035", "CSAFPID-8780036", "CSAFPID-8780037", "CSAFPID-8780038", "CSAFPID-8780039", "CSAFPID-8780040", "CSAFPID-8780041", "CSAFPID-8780042", "CSAFPID-8780043", "CSAFPID-8780044", "CSAFPID-8780045", "CSAFPID-8780046", "CSAFPID-8780047", "CSAFPID-8780048", "CSAFPID-8780049", "CSAFPID-8780050", "CSAFPID-8780051", "CSAFPID-8780052", "CSAFPID-8780053", "CSAFPID-8780054", "CSAFPID-8780055", "CSAFPID-8780056", "CSAFPID-9010916", "CSAFPID-9010919", "CSAFPID-9763668", "CSAFPID-9794251", "CSAFPID-9794252", "CSAFPID-9794253", "CSAFPID-9794254", "CSAFPID-9794255", "CSAFPID-9794256", "CSAFPID-9794257", "CSAFPID-9794258", "CSAFPID-9794259", "CSAFPID-9794260", "CSAFPID-9794323", "CSAFPID-9794324", "CSAFPID-9794325" ] } ], "title": "CVE-2026-54906" } ] }