CVE-2026-112907 | BDVDB-2026-400729 Detail
tox-devfilelock
Description#
filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, soft lock classes on Windows read an existing marker with _read_lock_file and remove a stale marker through break_lock_file using pathname operations that wait for an oplock break. Another local account with read access to an unheld marker can keep a Level 1 or batch oplock unanswered, causing SoftFileLock.acquire and related async or fallback locks to wait beyond timeout, blocking=False, and cancel_check. A stale marker under the oplock cannot be broken, but mutual exclusion remains intact and no file other than the marker is accessed. This issue is fixed in version 4.2.1.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact none, availability impact low. Attack vector: local.
Weaknesses#
- CWE-667 Improper Locking
References#
- https://github.com/tox-dev/filelock/security/advisories/GHSA-567q-5qvw-pf92
- https://github.com/tox-dev/filelock/pull/835
- https://github.com/tox-dev/filelock/commit/97d694a9a3ee1721d6c79a480174dfd9b060a080
- https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a
- https://github.com/tox-dev/filelock/releases/tag/4.2.1
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.