CVEvulnerability

CVE-2026-112906

4.7 MEDIUM Published 2026-10-20 Modified 2026-10-27 Official page ↗
Status
Analyzed
Published
2026-10-20
Last modified
2026-10-27
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.7 MEDIUM — CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-362, CWE-694

Description

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can reuse a stale observation when an attacker pre-dates and removes its own marker, at least two lock-user processes are waiting, coarse or matching modification times preserve the observation, and an honest contender creates a fresh marker on the reused inode, causing that live marker to be removed as stale. This issue is fixed in version 4.2.1.

Affected configurations

• tox-dev filelock (>= 4.1.0 < 4.2.1)

Related

Weakness · CWE (2)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
  • CWE-694 Use of Multiple Resources with Duplicate Identifier weakness

References