p PatchFirst

CVE-2026-112934

CVE-2026-112934 · filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record

This page contains facts from public vulnerability sources. Check the original advisory before updating.

filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pipe and stall the lock, or under a permissive hard-link policy to link a reachable target file and cause the lock user to write through it. This issue is fixed in version 4.2.1.

CVSS 6.1 · Medium · EPSS 0.1%

Published
Updated

Stack: system

Affected products and versions

  • filelock

    Versions
    • >= 4.0.0, < 4.2.1: Affected

    No fix published

  • python-filelock Debian:12

    Versions
    • 3.12.2-1
    • 3.12.3-1
    • 3.12.4-1
    • 3.13.1-1
    • 3.13.3-1
    • 3.13.4-1
    • 3.14.0-1
    • 3.15.4-1
    • 3.16.1-1
    • 3.16.1-2
    • 3.17.0-1
    • 3.18.0-1
    • 3.19.1-1
    • 3.20.0-1
    • 3.20.2-1
    • 3.20.3-1
    • 3.24.3-1
    • 3.25.0-1
    • 3.25.2-1
    • 3.29.0-1
    • 3.29.4-1
    • 3.29.5-1
    • 3.29.7-1
    • 3.32.0-1
    • 3.32.2-1
    • 3.32.4-1
    • 3.32.4-2
    • 3.32.5-1
    • 3.32.6-1
    • 3.9.0-1
    • 3.9.0-1+deb12u1
    • 4.0.1-1
    • 4.0.12-1
    • 4.1.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-filelock Debian:13

    Versions
    • 3.18.0-1
    • 3.18.0-1+deb13u1
    • 3.19.1-1
    • 3.20.0-1
    • 3.20.2-1
    • 3.20.3-1
    • 3.24.3-1
    • 3.25.0-1
    • 3.25.2-1
    • 3.29.0-1
    • 3.29.4-1
    • 3.29.5-1
    • 3.29.7-1
    • 3.32.0-1
    • 3.32.2-1
    • 3.32.4-1
    • 3.32.4-2
    • 3.32.5-1
    • 3.32.6-1
    • 4.0.1-1
    • 4.0.12-1
    • 4.1.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-filelock Debian:14

    Versions
    • 3.18.0-1
    • 3.19.1-1
    • 3.20.0-1
    • 3.20.2-1
    • 3.20.3-1
    • 3.24.3-1
    • 3.25.0-1
    • 3.25.2-1
    • 3.29.0-1
    • 3.29.4-1
    • 3.29.5-1
    • 3.29.7-1
    • 3.32.0-1
    • 3.32.2-1
    • 3.32.4-1
    • 3.32.4-2
    • 3.32.5-1
    • 3.32.6-1
    • 4.0.1-1
    • 4.0.12-1
    • 4.1.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-filelock Ubuntu:Pro:18.04:LTS

    Versions
    • 2.0.11-1
    • 2.0.12-1
    • 2.0.13-1
    • 3.0.0-2
    • 3.0.3-1
    • 3.0.4-1
    • 3.0.4-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-filelock Ubuntu:Pro:20.04:LTS

    Versions
    • 3.0.12-1
    • 3.0.12-2
    • 3.0.12-2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-filelock Ubuntu:Pro:22.04:LTS

    Versions
    • 3.0.12-2
    • 3.3.2-1
    • 3.4.0-1
    • 3.4.2-1
    • 3.4.2-2
    • 3.6.0-1
    • 3.6.0-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-filelock Ubuntu:Pro:24.04:LTS

    Versions
    • 3.12.2-1
    • 3.12.4-1
    • 3.13.1-1
    • 3.13.1-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-filelock Ubuntu:26.10

    Versions
    • 3.20.3-1
    • 3.29.4-1
    • 3.32.0-1
    • 3.32.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-filelock Ubuntu:26.04:LTS

    Versions
    • 3.18.0-1
    • 3.20.0-1
    • 3.20.2-1
    • 3.20.3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →