Vulnerability in Tox-Dev Filelock
CVE-2026-112907
filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, soft lock classes on Windows read an existing marker with _read_lock_file and remove a stale marker through break_lock_file using pathname operations that wait for an oplock break. Another local account with read access to an unheld marker can keep a Level 1 or batch oplock unanswered, causing SoftFileLock.acquire and related async or fallback locks to wait beyond timeout, blocking=False, and cancel_check. A stale marker under the oplock cannot be broken, but mutual exclusion remains intact and no file other than the marker is accessed. This issue is fixed in version 4.2.1.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 2.5 (Low). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Tox-Dev Filelock — versions >= 3.22.0, < 4.2.1
Weakness classification (CWE)
References
- https://github.com/tox-dev/filelock/commit/97d694a9a3ee1721d6c79a480174dfd9b060a080
- https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a
- https://github.com/tox-dev/filelock/pull/835
- https://github.com/tox-dev/filelock/releases/tag/4.2.1
- https://github.com/tox-dev/filelock/security/advisories/GHSA-567q-5qvw-pf92
Frequently asked questions
- What is CVE-2026-112907?
- CVE-2026-112907 is a low-severity vulnerability in Tox-Dev Filelock, classified under Improper Locking. CVSS score: 2.5/10. Published 2026-11-05.
- How severe is CVE-2026-112907?
- Low severity. CVSS v3 base score is 2.5 out of 10.