https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 11:01:13 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-10083 bdu:2026-10083 https://cve.radiocsirt.org/vuln/bdu:2026-10083 https://cve.radiocsirt.org/vuln/brew-asciidoctor-cve-2026-54904 <p><strong>Affected:</strong> Homebrew: asciidoctor</p> <p>### Summary `Concurrent::AtomicReference#update` can enter a permanent busy retry loop when the current value is `Float::NAN`.</p> <p>The issue is caused by the interaction between: - `AtomicReference#update`, which retries until `compare_and_set(old_value, new_value)` succeeds. - Numeric `compare_and_set`, which checks `old == old_value` before attempting the underlying atomic swap. - Ruby NaN semantics, where `Float::NAN == Float::NAN` is always `false`.</p> <p>As a result, once an `AtomicReference` contains `Float::NAN`, calling `#update` repeatedly evaluates the caller&#39;s block and never returns. In services that store externally derived numeric values in an `AtomicReference`, this can cause CPU exhaustion or permanent request/job hangs.</p> <p>### Version Software: concurrent-ruby Version: 1.3.6 Commit: 7a1b78941c081106c20a9ca0144ac73a48d254ab ### Details</p> <p>`AtomicReference#update` retries until `compare_and_set` returns true:</p> <p>```ruby def update true until compare_and_set(old_value = get, new_value = yield(old_value)) new_value end ```</p> <p>For numeric expected values, `compare_and_set` uses numeric equality before attempting the underlying atomic compare-and-set:</p> <p>```ruby def compare_and_set(old_value, new_value) if old_value.kind_of? Numeric while true old = get</p> <p>return false unless old.kind_of? Numeric return false unless old == old_value</p> <p>result = _compare_and_set(old, new_value) return result if result end else _compare_and_set(old_value,…</p> <p><strong>Affected:</strong> Homebrew: asciidoctor</p> <p>### Summary `Concurrent::AtomicReference#update` can enter a permanent busy retry loop when the current value is `Float::NAN`.</p> <p>The issue is caused by the interaction between: - `AtomicReference#update`, which retries until `compare_and_set(old_value, new_value)` succeeds. - Numeric `compare_and_set`, which checks `old == old_value` before attempting the underlying atomic swap. - Ruby NaN semantics, where `Float::NAN == Float::NAN` is always `false`.</p> <p>As a result, once an `AtomicReference` contains `Float::NAN`, calling `#update` repeatedly evaluates the caller&#39;s block and never returns. In services that store externally derived numeric values in an `AtomicReference`, this can cause CPU exhaustion or permanent request/job hangs.</p> <p>### Version Software: concurrent-ruby Version: 1.3.6 Commit: 7a1b78941c081106c20a9ca0144ac73a48d254ab ### Details</p> <p>`AtomicReference#update` retries until `compare_and_set` returns true:</p> <p>```ruby def update true until compare_and_set(old_value = get, new_value = yield(old_value)) new_value end ```</p> <p>For numeric expected values, `compare_and_set` uses numeric equality before attempting the underlying atomic compare-and-set:</p> <p>```ruby def compare_and_set(old_value, new_value) if old_value.kind_of? Numeric while true old = get</p> <p>return false unless old.kind_of? Numeric return false unless old == old_value</p> <p>result = _compare_and_set(old, new_value) return result if result end else _compare_and_set(old_value,…</p> https://cve.radiocsirt.org/vuln/brew-asciidoctor-cve-2026-54904 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0958 certfr-2026-avi-0958 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0958 https://cve.radiocsirt.org/vuln/cleanstart-2026-de16221 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: ruby-fluentd-1.18</p> <p>Multiple security vulnerabilities affect the ruby-fluentd-1.18 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: ruby-fluentd-1.18</p> <p>Multiple security vulnerabilities affect the ruby-fluentd-1.18 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-de16221 https://cve.radiocsirt.org/vuln/euvd-2026-348708 EUVD-2026-348708 https://cve.radiocsirt.org/vuln/euvd-2026-348708 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54904 <p>concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::AtomicReference#update can enter a permanent busy retry loop when the current value is Float::NAN. The issue is caused by the interaction between AtomicReference#update, which retries until compare_and_set(old_value, new_value) succeeds; Numeric compare_and_set, which checks old == old_value before attempting the underlying atomic swap.; and Ruby NaN semantics, where Float::NAN == Float::NAN is always false. As a result, once an AtomicReference contains Float::NAN, calling #update repeatedly evaluates the caller&#39;s block and never returns. In services that store externally derived numeric values in an AtomicReference, this can cause CPU exhaustion or permanent request/job hangs. This vulnerability is fixed in 1.3.7.</p> <p>concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::AtomicReference#update can enter a permanent busy retry loop when the current value is Float::NAN. The issue is caused by the interaction between AtomicReference#update, which retries until compare_and_set(old_value, new_value) succeeds; Numeric compare_and_set, which checks old == old_value before attempting the underlying atomic swap.; and Ruby NaN semantics, where Float::NAN == Float::NAN is always false. As a result, once an AtomicReference contains Float::NAN, calling #update repeatedly evaluates the caller&#39;s block and never returns. In services that store externally derived numeric values in an AtomicReference, this can cause CPU exhaustion or permanent request/job hangs. This vulnerability is fixed in 1.3.7.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-54904 https://cve.radiocsirt.org/vuln/ghsa-h8w8-99g7-qmvj <p><strong>Affected:</strong> RubyGems: concurrent-ruby</p> <p>### Summary `Concurrent::AtomicReference#update` can enter a permanent busy retry loop when the current value is `Float::NAN`.</p> <p>The issue is caused by the interaction between: - `AtomicReference#update`, which retries until `compare_and_set(old_value, new_value)` succeeds. - Numeric `compare_and_set`, which checks `old == old_value` before attempting the underlying atomic swap. - Ruby NaN semantics, where `Float::NAN == Float::NAN` is always `false`.</p> <p>As a result, once an `AtomicReference` contains `Float::NAN`, calling `#update` repeatedly evaluates the caller&#39;s block and never returns. In services that store externally derived numeric values in an `AtomicReference`, this can cause CPU exhaustion or permanent request/job hangs.</p> <p>### Version Software: concurrent-ruby Version: 1.3.6 Commit: 7a1b78941c081106c20a9ca0144ac73a48d254ab ### Details</p> <p>`AtomicReference#update` retries until `compare_and_set` returns true:</p> <p>```ruby def update true until compare_and_set(old_value = get, new_value = yield(old_value)) new_value end ```</p> <p>For numeric expected values, `compare_and_set` uses numeric equality before attempting the underlying atomic compare-and-set:</p> <p>```ruby def compare_and_set(old_value, new_value) if old_value.kind_of? Numeric while true old = get</p> <p>return false unless old.kind_of? Numeric return false unless old == old_value</p> <p>result = _compare_and_set(old, new_value) return result if result end else _compare_and_set(old_value,…</p> <p><strong>Affected:</strong> RubyGems: concurrent-ruby</p> <p>### Summary `Concurrent::AtomicReference#update` can enter a permanent busy retry loop when the current value is `Float::NAN`.</p> <p>The issue is caused by the interaction between: - `AtomicReference#update`, which retries until `compare_and_set(old_value, new_value)` succeeds. - Numeric `compare_and_set`, which checks `old == old_value` before attempting the underlying atomic swap. - Ruby NaN semantics, where `Float::NAN == Float::NAN` is always `false`.</p> <p>As a result, once an `AtomicReference` contains `Float::NAN`, calling `#update` repeatedly evaluates the caller&#39;s block and never returns. In services that store externally derived numeric values in an `AtomicReference`, this can cause CPU exhaustion or permanent request/job hangs.</p> <p>### Version Software: concurrent-ruby Version: 1.3.6 Commit: 7a1b78941c081106c20a9ca0144ac73a48d254ab ### Details</p> <p>`AtomicReference#update` retries until `compare_and_set` returns true:</p> <p>```ruby def update true until compare_and_set(old_value = get, new_value = yield(old_value)) new_value end ```</p> <p>For numeric expected values, `compare_and_set` uses numeric equality before attempting the underlying atomic compare-and-set:</p> <p>```ruby def compare_and_set(old_value, new_value) if old_value.kind_of? Numeric while true old = get</p> <p>return false unless old.kind_of? Numeric return false unless old == old_value</p> <p>result = _compare_and_set(old, new_value) return result if result end else _compare_and_set(old_value,…</p> https://cve.radiocsirt.org/vuln/ghsa-h8w8-99g7-qmvj https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-54904 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: ruby-concurrent, Ubuntu:18.04:LTS: ruby-concurrent, Ubuntu:20.04:LTS: ruby-concurrent, Ubuntu:22.04:LTS: ruby-concurrent, Ubuntu:24.04:LTS: ruby-concurrent, Ubuntu:25.10: ruby-concurrent, Ubuntu:26.04:LTS: ruby-concurrent</p> <p>concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::AtomicReference#update can enter a permanent busy retry loop when the current value is Float::NAN. The issue is caused by the interaction between AtomicReference#update, which retries until compare_and_set(old_value, new_value) succeeds; Numeric compare_and_set, which checks old == old_value before attempting the underlying atomic swap.; and Ruby NaN semantics, where Float::NAN == Float::NAN is always false. As a result, once an AtomicReference contains Float::NAN, calling #update repeatedly evaluates the caller&#39;s block and never returns. In services that store externally derived numeric values in an AtomicReference, this can cause CPU exhaustion or permanent request/job hangs. This vulnerability is fixed in 1.3.7.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: ruby-concurrent, Ubuntu:18.04:LTS: ruby-concurrent, Ubuntu:20.04:LTS: ruby-concurrent, Ubuntu:22.04:LTS: ruby-concurrent, Ubuntu:24.04:LTS: ruby-concurrent, Ubuntu:25.10: ruby-concurrent, Ubuntu:26.04:LTS: ruby-concurrent</p> <p>concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::AtomicReference#update can enter a permanent busy retry loop when the current value is Float::NAN. The issue is caused by the interaction between AtomicReference#update, which retries until compare_and_set(old_value, new_value) succeeds; Numeric compare_and_set, which checks old == old_value before attempting the underlying atomic swap.; and Ruby NaN semantics, where Float::NAN == Float::NAN is always false. As a result, once an AtomicReference contains Float::NAN, calling #update repeatedly evaluates the caller&#39;s block and never returns. In services that store externally derived numeric values in an AtomicReference, this can cause CPU exhaustion or permanent request/job hangs. This vulnerability is fixed in 1.3.7.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-54904 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2408 <p>Ein lokaler Angreifer kann eine Schwachstelle in HCL BigFix ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> <p>Ein lokaler Angreifer kann eine Schwachstelle in HCL BigFix ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2408