CVE-2026-112935: medium-severity vulnerability in tox-dev filelock
filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.7epss 0.1%
filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its own marker following the stale read, an honest contender creates a live successor on the reused inode, and the successor's modification time is not newer than the saved observation, causing the live marker to be removed and two holders to be admitted. This issue is fixed in version 4.2.1.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected products
tox-dev · filelockRelated CVEs — tox-dev filelock
In the same product, most dangerous first.
CVE-2026-112934MEDIUMfilelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its recordEPSS 0.2%CVE-2026-112936MEDIUMfilelock: ReadWriteLock follows a symlink at the lock path into SQLiteEPSS 0.2%CVE-2026-112909MEDIUMfilelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock pathEPSS 0.2%CVE-2026-112915MEDIUMfilelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeoutEPSS 0.2%CVE-2026-112912LOWfilelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock takerEPSS 0.2%CVE-2025-68146MEDIUMfilelock has TOCTOU race condition that allows symlink attacks during lock file creationEPSS 0.2%