GHSA-FJ95-FR6C-H845 filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record

SoftReadWriteLock and AsyncSoftReadWriteLock, which wraps one refreshes its holder record the file under .rw/holders/ that says a process holds or wants the lock on every poll of a waiting acquire and on every heartbeat the periodic refresh a holder runs to keep its record fresh. It does so by...

filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders

The stale-lock break shared by SoftFileLock, MarkerSoftFileLock and SoftFileLease and their async variants, and a FileLock that has fallen back to a soft lock on ENOSYS, the "not implemented" error recognises the marker it judged stale by two values. The marker is the lock file at , whose presenc...

GHSA-FQ56-3CX3-FJXP filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders

The stale-lock break shared by SoftFileLock, MarkerSoftFileLock and SoftFileLease and their async variants, and a FileLock that has fallen back to a soft lock on ENOSYS, the "not implemented" error recognises the marker it judged stale by two values. The marker is the lock file at , whose presenc...

0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5947 more potentially affected by CVE-2026-112935 via filelock (>=3.24.1, <=4.2.0)

filelock PYPI version =3.24.1, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112935 Source advisory: OSV:GHSA-FQ56-3CX3-FJXP...

EUVD-2026-105025

filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders...

0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5947 more potentially affected by CVE-2026-112935 via filelock (>=3.24.1, <=4.2.0)

filelock PYPI version =3.24.1, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112935 Source advisory: GHSA-FQ56-3CX3-FJXP...

PT-2026-130562

StrictSoftFileLock and AsyncStrictSoftFileLock apply the caller's mode to the sentinel the lock file at and to both claim files the files whose presence says a process wants or holds the lock. They create the two directories that hold the claims, .filelock and .filelock/claims, with a bare mkdir...

PT-2026-130563

filelock on Windows ignores the mode argument. FileLockpath, mode=0o600 creates the same file as FileLockpath: one with no security descriptor of its own the Windows record that says who may access a file. Its access list, or ACL, is whatever the lock directory hands down to new files. filelock...

PT-2026-130564

StrictSoftFileLock and AsyncStrictSoftFileLock check .filelock the coordination directory that holds the lock's state with one lstat call on its name. lstat reports what a name is without following a symbolic link a file that redirects to another path. After that check, the code reaches...

Filelock ReadWriteLock: SQLite Reopens The Lock Database By Name, So A Planted Symlink Or Journal File Makes The Lock Us

"ReadWriteLock" and "AsyncReadWriteLock" the SQLite-backed reader/writer lock hand SQLite a name they do not control. On Linux the lock validates its database through a descriptor the number the kernel gives a process for an open file. It then connects SQLite to "/proc/self/fd/", a Linux path tha...

Filelock: ReadWriteLock On The Hard-link Route Deletes Any Directory Another User Renames Onto Its .filelock-* Link Dire

"ReadWriteLock" and "AsyncReadWriteLock" the SQLite-backed reader/writer lock remove their private ".filelock-" link directories with "shutil.rmtree" a recursive delete on a remembered path. They do not check that the path still names the directory they created. This happens on the hard-link rout...

Filelock: SoftFileLock Stale-break Restore Follows A Swapped-in Symbolic Link And Hard-links A File Of The User Running

When a soft-lock stale break finds that the marker the lock file at "" it renamed aside was a live one recreated by a successor, the restore branch of "breaklockfile" checks the break name with "lstat" a check that reads a name without following a symbolic link and then calls "os.linkbreakpath,...

Filelock: ReadWriteLock On Windows Acts On SQLite Side Files Another Local User Places Beside Its Database

On Windows, "ReadWriteLock" and "AsyncReadWriteLock" the SQLite-backed reader/writer lock connect SQLite to the lock database by its path, in every directory. SQLite derives three side files from that path: "-journal", the rollback journal pages saved to undo an interrupted write; "-wal", the...

Filelock: On Windows An Oplock On A Soft Lock's Marker Holds SoftFileLock.acquire() Past Its Timeout And Blocks The Stal

On Windows the soft locks "SoftFileLock", "MarkerSoftFileLock", "SoftFileLease", their async forms, and a "FileLock" that fell back to a soft lock read their marker by path. The marker is the lock file whose presence says a process holds the lock. Each "acquire" attempt that finds a marker opens ...

Filelock: SoftFileLock Evicts A Fresh Lock File Whose Watched Age Another Local User's Pre-dated File Passed On Through

"SoftFileLock" and "MarkerSoftFileLock" evict an unparsable marker the lock file at "", whose presence says a process holds the lock once a waiting contender has watched it unchanged for two seconds. "SoftFileLease" expires a lease the same way. The watch tells two looks apart by the marker's...

CVE-2026-112907

On Windows the soft locks "SoftFileLock", "MarkerSoftFileLock", "SoftFileLease", their async forms, and a "FileLock" that fell back to a soft lock read their marker by path. The marker is the lock file whose presence says a process holds the lock. Each "acquire" attempt that finds a marker opens ...

atsfill (>=0.0.4.dev96, <=0.0.8.dev229), displayrws (>=0.1.3, <=0.1.4) +16 more potentially affected by CVE-2026-112907 via filelock (>=4.0.0, <=4.2.0)

filelock PYPI version =4.0.0, =0.0.4.dev96, =0.1.3, =5.4.2, =2026.10.0b1, =0.10.43, =0.10.43, =7.48.17, =0.10.43, =1.2.7, =0.2.1, =0.3.0, =2.2.0, =0.1.0, =0.1.2 and more Source cves: CVE-2026-112907 Source advisory: MEND:CVE-2026-112907...

atsfill (>=0.0.4.dev96, <=0.0.8.dev229), displayrws (>=0.1.3, <=0.1.4) +16 more potentially affected by CVE-2026-112913 via filelock (>=4.0.0, <=4.2.0)

filelock PYPI version =4.0.0, =0.0.4.dev96, =0.1.3, =5.4.2, =2026.10.0b1, =0.10.43, =0.10.43, =7.48.17, =0.10.43, =1.2.7, =0.2.1, =0.3.0, =2.2.0, =0.1.0, =0.1.2 and more Source cves: CVE-2026-112913 Source advisory: MEND:CVE-2026-112913...

CVE-2026-112913

On Windows, "ReadWriteLock" and "AsyncReadWriteLock" the SQLite-backed reader/writer lock connect SQLite to the lock database by its path, in every directory. SQLite derives three side files from that path: "-journal", the rollback journal pages saved to undo an interrupted write; "-wal", the...

filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name

ReadWriteLock and AsyncReadWriteLock the SQLite-backed reader/writer lock remove their private .filelock- link directories with shutil.rmtree a recursive delete on a remembered path. They do not check that the path still names the directory they created. This happens on the hard-link route a hard...