{"id":"UBUNTU-CVE-2026-112907","details":"filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, soft lock classes on Windows read an existing marker with _read_lock_file and remove a stale marker through break_lock_file using pathname operations that wait for an oplock break. Another local account with read access to an unheld marker can keep a Level 1 or batch oplock unanswered, causing SoftFileLock.acquire and related async or fallback locks to wait beyond timeout, blocking=False, and cancel_check. A stale marker under the oplock cannot be broken, but mutual exclusion remains intact and no file other than the marker is accessed. This issue is fixed in version 4.2.1.","modified":"2026-11-07T01:45:11.417652297Z","published":"2026-11-06T00:00:00Z","upstream":["CVE-2026-112907"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-112907"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-112907"},{"type":"REPORT","url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-567q-5qvw-pf92"},{"type":"REPORT","url":"https://github.com/tox-dev/filelock/pull/835"},{"type":"REPORT","url":"https://github.com/tox-dev/filelock/commit/97d694a9a3ee1721d6c79a480174dfd9b060a080"},{"type":"REPORT","url":"https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a"},{"type":"REPORT","url":"https://github.com/tox-dev/filelock/releases/tag/4.2.1"}],"affected":[{"package":{"name":"python-filelock","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/python-filelock?arch=source&distro=esm-apps%2Fbionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.11-1","2.0.12-1","2.0.13-1","3.0.0-2","3.0.3-1","3.0.4-1","3.0.4-1ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"python-filelock","binary_version":"3.0.4-1ubuntu0.1~esm1"},{"binary_name":"python3-filelock","binary_version":"3.0.4-1ubuntu0.1~esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-112907.json"}},{"package":{"name":"python-filelock","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/python-filelock?arch=source&distro=esm-apps%2Ffocal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.12-1","3.0.12-2","3.0.12-2ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"python3-filelock","binary_version":"3.0.12-2ubuntu0.1~esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-112907.json"}},{"package":{"name":"python-filelock","ecosystem":"Ubuntu:Pro:22.04:LTS","purl":"pkg:deb/ubuntu/python-filelock?arch=source&distro=esm-apps%2Fjammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.12-2","3.3.2-1","3.4.0-1","3.4.2-1","3.4.2-2","3.6.0-1","3.6.0-1ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"python3-filelock","binary_version":"3.6.0-1ubuntu0.1~esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-112907.json"}},{"package":{"name":"python-filelock","ecosystem":"Ubuntu:Pro:24.04:LTS","purl":"pkg:deb/ubuntu/python-filelock?arch=source&distro=esm-apps%2Fnoble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.12.2-1","3.12.4-1","3.13.1-1","3.13.1-1ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"python3-filelock","binary_version":"3.13.1-1ubuntu0.1~esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-112907.json"}},{"package":{"name":"python-filelock","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/python-filelock?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.20.3-1","3.29.4-1","3.32.0-1","3.32.2-1"],"ecosystem_specific":{"binaries":[{"binary_name":"python3-filelock","binary_version":"3.32.2-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-112907.json"}},{"package":{"name":"python-filelock","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/python-filelock?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.18.0-1","3.20.0-1","3.20.2-1","3.20.3-1"],"ecosystem_specific":{"binaries":[{"binary_name":"python3-filelock","binary_version":"3.20.3-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-112907.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"medium"}]}