File Lock Vulnerability in SoftFileLock Affects Multiple Python Versions
CVE-2026-112906

4.7MEDIUM

Key Information:

Vendor

Tox-dev

Status
Filelock
Vendor
CVE Published:
20 October 2026

What is CVE-2026-112906?

SoftFileLock, a file locking library for Python, is vulnerable due to improper handling of stale observations. This occurs when an attacker can manipulate locking mechanisms by pre-dating and removing their marker, causing contention among concurrent processes. As a result, a legitimate process can have its fresh marker removed as stale. The vulnerability affects versions 4.1.0 to 4.2.0 of SoftFileLock and has been addressed in version 4.2.1, emphasizing the importance of updating to secure file locking operations.

Affected Version(s)

filelock >= 4.1.0, < 4.2.1

References

https://github.com/tox-dev/filelock/security/advisories/G...
x_refsource_CONFIRM
https://github.com/tox-dev/filelock/commit/740ff666b62a88...
x_refsource_MISC
https://github.com/tox-dev/filelock/releases/tag/4.2.1
x_refsource_MISC

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.