File Lock Vulnerability in Python Product by Tox Dev
CVE-2026-112907

2.5LOW

Key Information:

Vendor

Tox-dev

Status
Filelock
Vendor
CVE Published:
5 November 2026

What is CVE-2026-112907?

The filelock library, versions 3.22.0 through 4.2.1, is susceptible to a flaw where local accounts can create a blocking condition due to how soft locks manage oplocks on Windows. This allows these accounts to keep an oplock unanswered, which can cause delays in acquiring file locks via SoftFileLock methods. However, mutual exclusion is not breached, indicating that while the blocking occurs, the integrity of file access remains intact. This issue was addressed in version 4.2.1.

Affected Version(s)

filelock >= 3.22.0, < 4.2.1

References

https://github.com/tox-dev/filelock/security/advisories/G...
x_refsource_CONFIRM
https://github.com/tox-dev/filelock/pull/835
x_refsource_MISC
https://github.com/tox-dev/filelock/commit/97d694a9a3ee17...
x_refsource_MISC

CVSS V3.1

Score:
2.5
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.