UBUNTU-CVE-2026-112907
Dashboard / Vulnerabilities / UBUNTU-CVE-2026-112907
Summary:
Details: filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, soft lock classes on Windows read an existing marker with _read_lock_file and remove a stale marker through break_lock_file using pathname operations that wait for an oplock break. Another local account with read access to an unheld marker can keep a Level 1 or batch oplock unanswered, causing SoftFileLock.acquire and related async or fallback locks to wait beyond timeout, blocking=False, and cancel_check. A stale marker under the oplock cannot be broken, but mutual exclusion remains intact and no file other than the marker is accessed. This issue is fixed in version 4.2.1.
References: https://ubuntu.com/security/CVE-2026-112907, https://www.cve.org/CVERecord?id=CVE-2026-112907, https://github.com/tox-dev/filelock/security/advisories/GHSA-567q-5qvw-pf92, https://github.com/tox-dev/filelock/pull/835, https://github.com/tox-dev/filelock/commit/97d694a9a3ee1721d6c79a480174dfd9b060a080, https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a, https://github.com/tox-dev/filelock/releases/tag/4.2.1
Affected packages
Package
Name: python-filelock
Purl: pkg:deb/ubuntu/python-filelock?arch=source&distro=esm-apps%2Fbionic
Affected ranges
Type: ECOSYSTEM
Events:
