p PatchFirst

CVE-2026-112906

CVE-2026-112906 · filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse

This page contains facts from public vulnerability sources. Check the original advisory before updating.

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can reuse a stale observation when an attacker pre-dates and removes its own marker, at least two lock-user processes are waiting, coarse or matching modification times preserve the observation, and an honest contender creates a fresh marker on the reused inode, causing that live marker to be removed as stale. This issue is fixed in version 4.2.1.

CVSS 4.7 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • filelock

    Versions
    • >= 4.1.0, < 4.2.1: Affected

    No fix published

  • python-filelock Debian:12

    Versions
    • 3.12.2-1
    • 3.12.3-1
    • 3.12.4-1
    • 3.13.1-1
    • 3.13.3-1
    • 3.13.4-1
    • 3.14.0-1
    • 3.15.4-1
    • 3.16.1-1
    • 3.16.1-2
    • 3.17.0-1
    • 3.18.0-1
    • 3.19.1-1
    • 3.20.0-1
    • 3.20.2-1
    • 3.20.3-1
    • 3.24.3-1
    • 3.25.0-1
    • 3.25.2-1
    • 3.29.0-1
    • 3.29.4-1
    • 3.29.5-1
    • 3.29.7-1
    • 3.32.0-1
    • 3.32.2-1
    • 3.32.4-1
    • 3.32.4-2
    • 3.32.5-1
    • 3.32.6-1
    • 3.9.0-1
    • 3.9.0-1+deb12u1
    • 4.0.1-1
    • 4.0.12-1
    • 4.1.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-filelock Debian:13

    Versions
    • 3.18.0-1
    • 3.18.0-1+deb13u1
    • 3.19.1-1
    • 3.20.0-1
    • 3.20.2-1
    • 3.20.3-1
    • 3.24.3-1
    • 3.25.0-1
    • 3.25.2-1
    • 3.29.0-1
    • 3.29.4-1
    • 3.29.5-1
    • 3.29.7-1
    • 3.32.0-1
    • 3.32.2-1
    • 3.32.4-1
    • 3.32.4-2
    • 3.32.5-1
    • 3.32.6-1
    • 4.0.1-1
    • 4.0.12-1
    • 4.1.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-filelock Debian:14

    Versions
    • 3.18.0-1
    • 3.19.1-1
    • 3.20.0-1
    • 3.20.2-1
    • 3.20.3-1
    • 3.24.3-1
    • 3.25.0-1
    • 3.25.2-1
    • 3.29.0-1
    • 3.29.4-1
    • 3.29.5-1
    • 3.29.7-1
    • 3.32.0-1
    • 3.32.2-1
    • 3.32.4-1
    • 3.32.4-2
    • 3.32.5-1
    • 3.32.6-1
    • 4.0.1-1
    • 4.0.12-1
    • 4.1.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • filelock PyPI

    Versions
    • 4.1.0
    • 4.1.1
    • 4.1.2
    • 4.2.0
    Affected ranges
    • ECOSYSTEM: ≥ 4.1.0, < 4.2.1

    Update to 4.2.1

  • python-filelock Ubuntu:Pro:18.04:LTS

    Versions
    • 2.0.11-1
    • 2.0.12-1
    • 2.0.13-1
    • 3.0.0-2
    • 3.0.3-1
    • 3.0.4-1
    • 3.0.4-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-filelock Ubuntu:Pro:20.04:LTS

    Versions
    • 3.0.12-1
    • 3.0.12-2
    • 3.0.12-2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-filelock Ubuntu:Pro:22.04:LTS

    Versions
    • 3.0.12-2
    • 3.3.2-1
    • 3.4.0-1
    • 3.4.2-1
    • 3.4.2-2
    • 3.6.0-1
    • 3.6.0-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-filelock Ubuntu:Pro:24.04:LTS

    Versions
    • 3.12.2-1
    • 3.12.4-1
    • 3.13.1-1
    • 3.13.1-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-filelock Ubuntu:26.10

    Versions
    • 3.20.3-1
    • 3.29.4-1
    • 3.32.0-1
    • 3.32.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-filelock Ubuntu:26.04:LTS

    Versions
    • 3.18.0-1
    • 3.20.0-1
    • 3.20.2-1
    • 3.20.3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →