CVE-2026-112907
1 advisory.
PyPI/filelock CVE-2026-112907: low 2.5
filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break
Action: Upgrade filelock to 4.2.1 or later.
pip install filelock==4.2.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.22.0 | 4.2.1 | - |
Fixed versions
| 4.2.1 |
Sources
- osv: GHSA-567q-5qvw-pf92
- https://github.com/tox-dev/filelock/security/advisories/GHSA-567q-5qvw-pf92
- https://github.com/tox-dev/filelock/pull/835
- https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a
- https://github.com/tox-dev/filelock
- https://github.com/tox-dev/filelock/releases/tag/4.2.1
CVE-2026-112907 · published · modified · JSON