Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112907— filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break

Quick assessment

Affected
tox-dev filelock
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

filelock 是一个跨平台的 Python 文件锁库。在 3.22.0 至 4.2.1 版本中，Windows 平台上的软锁（soft lock）类在调用 读取现有标记文件，并通过 移除过期标记时，使用了会等待操作锁（oplock）中断的路径名操作。若存在另一个拥有对该未持有标记文件读取权限的本地账户，该账户可保持一级操作锁或批处理操作锁处于未响应状态，导致 及相关异步或回退锁机制在超时、 以及 的情况下持续等待。虽然处于操作锁下的过期标记无法被移除，但互斥性依然得到保障，且除标记文件外不会访问其他文件。该问题

CVSS 2.5 · Low

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112907

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break
Source: CVE Program / CVE List V5
Vulnerability Description
filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, soft lock classes on Windows read an existing marker with _read_lock_file and remove a stale marker through break_lock_file using pathname operations that wait for an oplock break. Another local account with read access to an unheld marker can keep a Level 1 or batch oplock unanswered, causing SoftFileLock.acquire and related async or fallback locks to wait beyond timeout, blocking=False, and cancel_check. A stale marker under the oplock cannot be broken, but mutual exclusion remains intact and no file other than the marker is accessed. This issue is fixed in version 4.2.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
加锁机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
tox-dev filelock >= 3.22.0, < 4.2.1 -

II. Public POCs for CVE-2026-112907

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112907

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-112907 (1)

Vendor Pages for CVE-2026-112907 (1)

Other References for CVE-2026-112907 (2)

Same Patch Batch · tox-dev · 2026-11-05 · 5 CVEs total

CVE-2026-112938 5.8 MEDIUM filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and cre
CVE-2026-112908 5.3 MEDIUM filelock: StrictSoftFileLock creates its claim directories without the lock mode, so anoth
CVE-2026-112910 5.3 MEDIUM filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database i
CVE-2026-112913 3.3 LOW filelock: ReadWriteLock on Windows acts on SQLite side files another local user places bes

IV. Related Vulnerabilities

Same product: filelock
Same vendor: tox-dev
Same weakness: CWE-667