Log in Start free

Vulnerability · Published Nov 5, 2026 · Assigned by GitHub_M

CVE-2026-112907filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break

Low 2.5

In plain English

A low-severity security flaw in filelock from tox-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)2.5Low
Exploit odds (30 days)0.1%top 99.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, soft lock classes on Windows read an existing marker with _read_lock_file and remove a stale marker through break_lock_file using pathname operations that wait for an oplock break. Another local account with read access to an unheld marker can keep a Level 1 or batch oplock unanswered, causing SoftFileLock.acquire and related async or fallback locks to wait beyond timeout, blocking=False, and cancel_check. A stale marker under the oplock cannot be broken, but mutual exclusion remains intact and no file other than the marker is accessed. This issue is fixed in version 4.2.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIfilelock4.2.1GHSA-567q-5qvw-pf92
Ubuntu:26.04:LTSpython-filelockno fix listedUBUNTU-CVE-2026-112907
Ubuntu:26.10python-filelockno fix listedUBUNTU-CVE-2026-112907

Affected products (as reported)

VendorProductVersions
tox-dev filelock >= 3.22.0, < 4.2.1

Weakness: CWE-667 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

References