What’s Vulnerable › Vulnerabilities

CVE-2026-112935: filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders

• Severity: medium (CVSS 4.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-10-20 · updated 2026-10-28
• Weakness: CWE-367

Description

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its own marker following the stale read, an honest contender creates a live successor on the reused inode, and the successor's modification time is not newer than the saved observation, causing the live marker to be removed and two holders to be admitted. This issue is fixed in version 4.2.1.

Affected products

• tox-dev filelock: from 3.22.0 before 4.2.1 — fixed in 4.2.1
• tox-dev filelock: from 3.22.0, < 4.2.1

How to fix

Upgrade to a fixed version: tox-dev filelock 4.2.1. Check the vendor advisory for mitigations.

References

• https://github.com/tox-dev/filelock/commit/740ff666b62a88496c8d7394e4e6230605e4d62b
• https://github.com/tox-dev/filelock/pull/843
• https://github.com/tox-dev/filelock/releases/tag/4.2.1
• https://github.com/tox-dev/filelock/security/advisories/GHSA-fq56-3cx3-fjxp
• https://github.com/tox-dev/filelock/security/advisories/GHSA-fq56-3cx3-fjxp

Get alerted when CVE-2026-112935 or the next vulnerability affects your stack