LOW 2.5 GitHub
CVE-2026-112907
filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break
On Windows the soft locks (`SoftFileLock`, `MarkerSoftFileLock`, `SoftFileLease`, their async forms, and a `FileLock` that fell back to a soft lock) read their marker by path. The marker is the lock file whose presence says a process holds the lock. Each `acquire()` attempt that finds a marker opens it with `os.open` to read the holder's process id, and the lock renames and deletes a marker it judges stale, by path. On Windows each of these calls waits for an oplock. An oplock (opportunistic loc
Affected Products
- pip/filelock >= 3.22.0, <= 4.2.0
References
- https://github.com/advisories/GHSA-567q-5qvw-pf92
- https://github.com/tox-dev/filelock/security/advisories/GHSA-567q-5qvw-pf92
- https://github.com/tox-dev/filelock/pull/835
- https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a
This low severity vulnerability with a CVSS score of 2.5 was published on 2026-10-23 via GitHub. Affected: pip/filelock >= 3.22.0, <= 4.2.0.
vulnfeed aggregates 17167 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.