CVE-2026-112936

The filelock Python library (versions 3.20.4 through 4.0.9 ) contains a vulnerability where ReadWriteLock and AsyncReadWriteLock resolve lock paths and pass them to SQLite without rejecting a final symbolic link. This allows a local user with the ability to create names in the lock directory to r...

CVE-2026-112935 filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its own marker following the stale read, an honest contender creates a live successor on the reused inode, and the successor's modification time is not...

CVE-2026-112935

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its own marker following the stale read, an honest contender creates a live successor on the reused inode, and the successor's modification time is not...

CVE-2026-112935 filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its own marker following the stale read, an honest contender creates a live successor on the reused inode, and the successor's modification time is not...

EUVD-2026-105025

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its own marker following the stale read, an honest contender creates a live successor on the reused inode, and the successor's modification time is not...

CVE-2026-112935

The filelock library, a platform-independent file lock for Python, is vulnerable to a TOCTOU Race Condition in its SoftFileLock component. In versions 3.22.0 through 4.2.0 , an attacker can free their own marker after a stale read. If an honest contender subsequently creates a live successor on a...

CVE-2026-112934

The filelock Python library (versions 4.0.0 through 4.2.1 ) contains a vulnerability where the SoftReadWriteLock refreshes holder records by name. A local user with rename access to the lock directory can replace a record with a named pipe , causing the lock to hang, or link a reachable target fi...

CVE-2026-112934 filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record

filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pipe and stall the lock, or under a permissive hard-link polic...

CVE-2026-112934

filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pipe and stall the lock, or under a permissive hard-link polic...

CVE-2026-112934

filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pipe and stall the lock, or under a permissive hard-link polic...

CVE-2026-112934 filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record

filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pipe and stall the lock, or under a permissive hard-link polic...

CVE-2026-112934 filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record

filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pipe and stall the lock, or under a permissive hard-link polic...

EUVD-2026-105023

filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pipe and stall the lock, or under a permissive hard-link polic...

CVE-2026-112915 filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock can open a crafted SQLite lock database without bounding schema and query work, allowing another local user who can replace the database to make acquisition stall or hang; versions from 3.20.4 expose...

CVE-2026-112915

The filelock Python library (versions 3.20.4 through 4.2.0 ) is vulnerable to a Denial of Service (DoS) via CWE-400 in its ReadWriteLock component. A local user capable of replacing the lock database can provide a crafted SQLite database that lacks bounded schema and query work limits. This cause...

CVE-2026-112915 filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock can open a crafted SQLite lock database without bounding schema and query work, allowing another local user who can replace the database to make acquisition stall or hang; versions from 3.20.4 expose...

EUVD-2026-105021

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock can open a crafted SQLite lock database without bounding schema and query work, allowing another local user who can replace the database to make acquisition stall or hang; versions from 3.20.4 expose...

CVE-2026-112915

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock can open a crafted SQLite lock database without bounding schema and query work, allowing another local user who can replace the database to make acquisition stall or hang; versions from 3.20.4 expose...

CVE-2026-112915 filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock can open a crafted SQLite lock database without bounding schema and query work, allowing another local user who can replace the database to make acquisition stall or hang; versions from 3.20.4 expose...

CVE-2026-112914 filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock can restore a stale marker by name after moving it aside, allowing another local user with rename access in a non-sticky lock directory to swap in a symbolic link and, on a runtime that follows the link...