Skip to content
OpenAdvisories
Low · 2.5 CVE-2026-112907 EUVD-2026-117813GHSA-567q-5qvw-pf92

filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break

Published Nov 5, 2026 · Updated Nov 10, 2026 · Assigned by GitHub_M

Description

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, soft lock classes on Windows read an existing marker with _read_lock_file and remove a stale marker through break_lock_file using pathname operations that wait for an oplock break. Another local account with read access to an unheld marker can keep a Level 1 or batch oplock unanswered, causing SoftFileLock.acquire and related async or fallback locks to wait beyond timeout, blocking=False, and cancel_check. A stale marker under the oplock cannot be broken, but mutual exclusion remains intact and no file other than the marker is accessed. This issue is fixed in version 4.2.1.

Affected products

VendorProductAffectedFixed
tox-dev filelock >= 3.22.0, < 4.2.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Ubuntu 26.10 python-filelock No fix yet —
Ubuntu 26.04 LTS python-filelock No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS python-filelock No fix yet —
Ubuntu Pro 22.04 LTS python-filelock No fix yet —
Ubuntu Pro 20.04 LTS python-filelock No fix yet —
Ubuntu Pro 18.04 LTS python-filelock No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling open-webui 0.12.3-r10 —
Wolfi rolling py3-cassandra-medusa 0.31.0-r3 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI filelock >= 3.22.0, < 4.2.1 4.2.1 GHSA-567q-5qvw-pf92

References