CVE-2026-112935

The filelock library, a platform-independent file lock for Python, is vulnerable to a TOCTOU Race Condition in its SoftFileLock component. In versions 3.22.0 through 4.2.0 , an attacker can free their own marker after a stale read. If an honest contender subsequently creates a live successor on a...

CVE-2026-112935 filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its own marker following the stale read, an honest contender creates a live successor on the reused inode, and the successor's modification time is not...