p PatchFirst

CVE-2026-112939

CVE-2026-112939 · filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker

This page contains facts from public vulnerability sources. Check the original advisory before updating.

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as another process of the holder's account or root to act as a confused deputy, remove the live marker, and admit another holder. This issue is fixed in version 4.2.1.

CVSS 4.7 · Medium · EPSS 0.1%

Published
Updated

Stack: system

Affected products and versions

  • filelock

    Versions
    • >= 3.22.0, < 4.2.1: Affected

    No fix published

  • python-filelock Debian:12

    Versions
    • 3.12.2-1
    • 3.12.3-1
    • 3.12.4-1
    • 3.13.1-1
    • 3.13.3-1
    • 3.13.4-1
    • 3.14.0-1
    • 3.15.4-1
    • 3.16.1-1
    • 3.16.1-2
    • 3.17.0-1
    • 3.18.0-1
    • 3.19.1-1
    • 3.20.0-1
    • 3.20.2-1
    • 3.20.3-1
    • 3.24.3-1
    • 3.25.0-1
    • 3.25.2-1
    • 3.29.0-1
    • 3.29.4-1
    • 3.29.5-1
    • 3.29.7-1
    • 3.32.0-1
    • 3.32.2-1
    • 3.32.4-1
    • 3.32.4-2
    • 3.32.5-1
    • 3.32.6-1
    • 3.9.0-1
    • 3.9.0-1+deb12u1
    • 4.0.1-1
    • 4.0.12-1
    • 4.1.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-filelock Debian:13

    Versions
    • 3.18.0-1
    • 3.18.0-1+deb13u1
    • 3.19.1-1
    • 3.20.0-1
    • 3.20.2-1
    • 3.20.3-1
    • 3.24.3-1
    • 3.25.0-1
    • 3.25.2-1
    • 3.29.0-1
    • 3.29.4-1
    • 3.29.5-1
    • 3.29.7-1
    • 3.32.0-1
    • 3.32.2-1
    • 3.32.4-1
    • 3.32.4-2
    • 3.32.5-1
    • 3.32.6-1
    • 4.0.1-1
    • 4.0.12-1
    • 4.1.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-filelock Debian:14

    Versions
    • 3.18.0-1
    • 3.19.1-1
    • 3.20.0-1
    • 3.20.2-1
    • 3.20.3-1
    • 3.24.3-1
    • 3.25.0-1
    • 3.25.2-1
    • 3.29.0-1
    • 3.29.4-1
    • 3.29.5-1
    • 3.29.7-1
    • 3.32.0-1
    • 3.32.2-1
    • 3.32.4-1
    • 3.32.4-2
    • 3.32.5-1
    • 3.32.6-1
    • 4.0.1-1
    • 4.0.12-1
    • 4.1.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-filelock Ubuntu:Pro:18.04:LTS

    Versions
    • 2.0.11-1
    • 2.0.12-1
    • 2.0.13-1
    • 3.0.0-2
    • 3.0.3-1
    • 3.0.4-1
    • 3.0.4-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-filelock Ubuntu:Pro:20.04:LTS

    Versions
    • 3.0.12-1
    • 3.0.12-2
    • 3.0.12-2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-filelock Ubuntu:Pro:22.04:LTS

    Versions
    • 3.0.12-2
    • 3.3.2-1
    • 3.4.0-1
    • 3.4.2-1
    • 3.4.2-2
    • 3.6.0-1
    • 3.6.0-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-filelock Ubuntu:Pro:24.04:LTS

    Versions
    • 3.12.2-1
    • 3.12.4-1
    • 3.13.1-1
    • 3.13.1-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-filelock Ubuntu:26.10

    Versions
    • 3.20.3-1
    • 3.29.4-1
    • 3.32.0-1
    • 3.32.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-filelock Ubuntu:26.04:LTS

    Versions
    • 3.18.0-1
    • 3.20.0-1
    • 3.20.2-1
    • 3.20.3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →