CVE-2026-112907 (CVSS 2.5)

Description

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, soft lock classes on Windows read an existing marker with _read_lock_file and remove a stale marker through break_lock_file using pathname operations that wait for an oplock break. Another local account with read access to an unheld marker can keep a Level 1 or batch oplock unanswered, causing SoftFileLock.acquire and related async or fallback locks to wait beyond timeout, blocking=False, and cancel_check. A stale marker under the oplock cannot be broken, but mutual exclusion remains intact and no file other than the marker is accessed. This issue is fixed in version 4.2.1.

Is your site exposed to CVE-2026-112907?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

2.5

LOW

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

EPSS — Exploit Prediction

0.0010

Probability of exploitation

0.01%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-667 CWE-667

References

Other References

https://github.com/tox-dev/filelock/commit/97d694a9a3ee1721d6c79a480174dfd9b060a080 https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a https://github.com/tox-dev/filelock/pull/835 https://github.com/tox-dev/filelock/releases/tag/4.2.1 https://github.com/tox-dev/filelock/security/advisories/GHSA-567q-5qvw-pf92 https://github.com/tox-dev/filelock/security/advisories/GHSA-567q-5qvw-pf92

Frequently Asked Questions

What is CVE-2026-112907? +

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, soft lock classes on Windows read an existing marker with _read_lock_file and remove a stale marker through break_lock_file using pathname operations that wait for an oplock break. Another local account with read access to an unheld marker can keep a Level 1 or batch oplock unanswered, causing SoftFileLock.acquire and related async or fallback locks to wait beyond timeout, blocking=False, and cancel_check. A stale marker under the oplock cannot be broken, but mutual exclusion remains intact and no file other than the marker is accessed. This issue is fixed in version 4.2.1. It has a CVSS v3.1 base score of 2.5 (LOW).

How severe is CVE-2026-112907? +

CVE-2026-112907 has a CVSS v3.1 score of 2.5 out of 10, rated LOW. This is a low-severity vulnerability with limited impact. The EPSS score is 0.0010, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-112907? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-1221

A Zigbee Radio Co-Processor (RCP), which is using SiLabs EmberZNet Zigbee stack, was unable to send messages to the host …

CVE-2025-10151

Improper locking vulnerability in Softing Industrial Automation GmbH gateways allows infected memory and/or resource leak exposure.This issue affects smartLink HW-PN: …

CVE-2026-45404

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems …

CVE-2026-110803

VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases …

CVE-2026-111879

DBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a failed open_data does …

CVE-2026-54906 9.8

concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReadWriteLock#release_write_lock does not verify that the calling thread acquired …