Vulnerability · Published Oct 20, 2026 · Assigned by GitHub_M
CVE-2026-112935filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders
Medium 4.7
In plain English
A medium-severity security flaw in filelock from tox-dev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its own marker following the stale read, an honest contender creates a live successor on the reused inode, and the successor's modification time is not newer than the saved observation, causing the live marker to be removed and two holders to be admitted. This issue is fixed in version 4.2.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | python-filelock | no fix listed | DEBIAN-CVE-2026-112935 |
| Debian:13 | python-filelock | no fix listed | DEBIAN-CVE-2026-112935 |
| Debian:14 | python-filelock | no fix listed | DEBIAN-CVE-2026-112935 |
| PyPI | filelock | 4.2.1 | GHSA-fq56-3cx3-fjxp |
| Ubuntu:26.04:LTS | python-filelock | no fix listed | UBUNTU-CVE-2026-112935 |
| Ubuntu:26.10 | python-filelock | no fix listed | UBUNTU-CVE-2026-112935 |
Affected products (as reported)
Weakness: CWE-367 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
References
- https://github.com/tox-dev/filelock/security/advisories/GHSA-fq56-3cx3-fjxp x_refsource_CONFIRM
- https://github.com/tox-dev/filelock/pull/843 x_refsource_MISC
- https://github.com/tox-dev/filelock/commit/740ff666b62a88496c8d7394e4e6230605e4d62b x_refsource_MISC
- https://github.com/tox-dev/filelock/releases/tag/4.2.1 x_refsource_MISC