CVE-2026-112907
Dashboard / Vulnerabilities / CVE-2026-112907
Summary: filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break
Details: filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, soft lock classes on Windows read an existing marker with _read_lock_file and remove a stale marker through break_lock_file using pathname operations that wait for an oplock break. Another local account with read access to an unheld marker can keep a Level 1 or batch oplock unanswered, causing SoftFileLock.acquire and related async or fallback locks to wait beyond timeout, blocking=False, and cancel_check. A stale marker under the oplock cannot be broken, but mutual exclusion remains intact and no file other than the marker is accessed. This issue is fixed in version 4.2.1.
References: https://github.com/tox-dev/filelock/releases/tag/4.2.1, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112907.json, https://github.com/tox-dev/filelock/security/advisories/GHSA-567q-5qvw-pf92, https://nvd.nist.gov/vuln/detail/CVE-2026-112907, https://github.com/tox-dev/filelock/commit/97d694a9a3ee1721d6c79a480174dfd9b060a080, https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a, https://github.com/tox-dev/filelock/pull/835
Affected packages
Package
Name:
Purl:
Affected ranges
Type: GIT
Events:
