{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-112907","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","state":"PUBLISHED","assignerShortName":"GitHub_M","dateReserved":"2026-10-19T20:16:09.857Z","datePublished":"2026-11-05T21:50:04.632Z","dateUpdated":"2026-11-05T21:50:04.632Z"},"containers":{"cna":{"title":"filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break","problemTypes":[{"descriptions":[{"cweId":"CWE-667","lang":"en","description":"CWE-667: Improper Locking","type":"CWE"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":2.5,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"}}],"references":[{"name":"https://github.com/tox-dev/filelock/security/advisories/GHSA-567q-5qvw-pf92","tags":["x_refsource_CONFIRM"],"url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-567q-5qvw-pf92"},{"name":"https://github.com/tox-dev/filelock/pull/835","tags":["x_refsource_MISC"],"url":"https://github.com/tox-dev/filelock/pull/835"},{"name":"https://github.com/tox-dev/filelock/commit/97d694a9a3ee1721d6c79a480174dfd9b060a080","tags":["x_refsource_MISC"],"url":"https://github.com/tox-dev/filelock/commit/97d694a9a3ee1721d6c79a480174dfd9b060a080"},{"name":"https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a","tags":["x_refsource_MISC"],"url":"https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a"},{"name":"https://github.com/tox-dev/filelock/releases/tag/4.2.1","tags":["x_refsource_MISC"],"url":"https://github.com/tox-dev/filelock/releases/tag/4.2.1"}],"affected":[{"vendor":"tox-dev","product":"filelock","versions":[{"version":">= 3.22.0, < 4.2.1","status":"affected"}]}],"providerMetadata":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-11-05T21:50:04.632Z"},"descriptions":[{"lang":"en","value":"filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, soft lock classes on Windows read an existing marker with _read_lock_file and remove a stale marker through break_lock_file using pathname operations that wait for an oplock break. Another local account with read access to an unheld marker can keep a Level 1 or batch oplock unanswered, causing SoftFileLock.acquire and related async or fallback locks to wait beyond timeout, blocking=False, and cancel_check. A stale marker under the oplock cannot be broken, but mutual exclusion remains intact and no file other than the marker is accessed. This issue is fixed in version 4.2.1."}],"source":{"advisory":"GHSA-567q-5qvw-pf92","discovery":"UNKNOWN"}}}}