{"id":"CVE-2026-112907","published":"2026-11-05T22:17:46.513","lastModified":"2026-11-05T22:17:46.513","description":"filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, soft lock classes on Windows read an existing marker with _read_lock_file and remove a stale marker through break_lock_file using pathname operations that wait for an oplock break. Another local account with read access to an unheld marker can keep a Level 1 or batch oplock unanswered, causing SoftFileLock.acquire and related async or fallback locks to wait beyond timeout, blocking=False, and cancel_check. A stale marker under the oplock cannot be broken, but mutual exclusion remains intact and no file other than the marker is accessed. This issue is fixed in version 4.2.1.","cvssScore":2.5,"cvssSeverity":"LOW","cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","cwes":["CWE-667"],"vendors":[],"products":[],"references":[{"url":"https://github.com/tox-dev/filelock/commit/97d694a9a3ee1721d6c79a480174dfd9b060a080","tags":[]},{"url":"https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a","tags":[]},{"url":"https://github.com/tox-dev/filelock/pull/835","tags":[]},{"url":"https://github.com/tox-dev/filelock/releases/tag/4.2.1","tags":[]},{"url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-567q-5qvw-pf92","tags":[]}],"exploitRefs":[{"url":"https://github.com/tox-dev/filelock/commit/97d694a9a3ee1721d6c79a480174dfd9b060a080","tags":[]},{"url":"https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a","tags":[]},{"url":"https://github.com/tox-dev/filelock/pull/835","tags":[]},{"url":"https://github.com/tox-dev/filelock/releases/tag/4.2.1","tags":[]},{"url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-567q-5qvw-pf92","tags":[]}],"hasPoc":true,"ai":null}