CVE-2026-112907

CVSS 2.5 (low) · published 2026-11-05

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, soft lock classes on Windows read an existing marker with _read_lock_file and remove a stale marker through break_lock_file using pathname operations that wait for an oplock break. Another local account with read access to an unheld marker can keep a Level 1 or batch oplock unanswered, causing SoftFileLock.acquire and related async or fallback locks to wait beyond timeout, blocking=False, and cancel_check. A stale marker under the oplock cannot be broken, but mutual exclusion remains intact and no file other than the marker is accessed. This issue is fixed in version 4.2.1.

Weakness: CWE-667

Source: NVD CVE-2026-112907

References

• https://github.com/tox-dev/filelock/commit/97d694a9a3ee1721d6c79a480174dfd9b060a080
• https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a
• https://github.com/tox-dev/filelock/pull/835
• https://github.com/tox-dev/filelock/releases/tag/4.2.1
• https://github.com/tox-dev/filelock/security/advisories/GHSA-567q-5qvw-pf92
• https://github.com/tox-dev/filelock/security/advisories/GHSA-567q-5qvw-pf92

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.