CVE-2026-112907

2.5 lowEPSS 0.1%Fix available

Low (2.5) in tox-dev filelock. EPSS 0.1% estimated probability of exploitation activity in the next 30 days. Fixed in filelock 4.2.1.

On this page

Severity
Ask an AI about this CVE
Affected
Versions
Packages (OSV)
Linux distributions
Red Hat
Attack patterns (CAPEC)
References
Your exposure

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, soft lock classes on Windows read an existing marker with _read_lock_file and remove a stale marker through break_lock_file using pathname operations that wait for an oplock break. Another local account with read access to an unheld marker can keep a Level 1 or batch oplock unanswered, causing SoftFileLock.acquire and related async or fallback locks to wait beyond timeout, blocking=False, and cancel_check. A stale marker under the oplock cannot be broken, but mutual exclusion remains intact and no file other than the marker is accessed. This issue is fixed in version 4.2.1.

Severity

CVSS 3.1

2.5 low

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

EPSS: 0.1% estimated probability of exploitation activity in the next 30 days; 1st percentile. Scored 2026-11-10. A forecast for this CVE across the internet, not for your own systems.
CISA's assessment (SSVC): Exploitation: PoC · Automatable: no · Technical impact: partial, assessed 2026-11-10. From CISA's Vulnrichment in the CVE List: whether it is exploited, whether exploiting it can be automated, and how much control it gives.
CWE: CWE-667 Improper Locking
Published: 2026-11-05 22:17 UTC
Modified: 2026-11-10 05:17 UTC
Assigned by: GitHub_M (CNA)
NVD analysis: Awaiting analysis
Record from: the NVD, synced 2026-11-10 05:34 UTC

Ask an AI about this CVE

ChatGPT Claude Google AI Mode

Show the prompt

Explain CVE-2026-112907 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-112907?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-112907?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-112907 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.

Affected

tox-dev:filelock

Versions

From the CNA's record in the CVE List.

Product	Affected
tox-dev filelock	>= 3.22.0, < 4.2.1

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-567q-5qvw-pf92	PyPI	filelock	>=3.22.0 <4.2.1	4.2.1

Linux distributions

Distribution	Release	Package	Fixed in	Advisory
Ubuntu	26.04:LTS, 26.10, Pro:18.04:LTS and 3 more	python-filelock	no fix listed	UBUNTU-CVE-2026-112907

From the distributions' data via OSV.dev: Ubuntu Security Notices © Canonical Ltd., CC BY-SA 4.0. Modified: reformatted and linked to CVE records. Credits. On the distributions' own pages: Ubuntu.

Red Hat

Red Hat rates this Low.

Red Hat's statement

This vulnerability is rated as Low severity because it exclusively targets Windows-specific opportunistic locking (oplock) behavior, posing no direct threat to Linux environments. Red Hat enterprise products and container deployments execute on Linux platforms utilizing standard POSIX file locking APIs rather than Windows path-handling semantics. Because the underlying opportunistic lock mechanism and affected system calls are absent on Linux, Red Hat environments are not affected by this denial of service.

Red Hat's mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Product	Package	State	Advisory
Red Hat OpenShift AI (RHOAI)	rhoai/odh-mlflow-rhel9	Fix deferred

Contains Red Hat Security Data © Red Hat, Inc., licensed under CC BY 4.0. Source: https://access.redhat.com/security/data. Modified: reformatted. Red Hat's page for CVE-2026-112907.

Attack patterns (CAPEC)

CAPEC-25 Forced Deadlock Likelihood: Low · Severity: High
CAPEC-26 Leveraging Race Conditions Likelihood: High · Severity: High
CAPEC-27 Leveraging Race Conditions via Symbolic Links Likelihood: Medium · Severity: High

The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits.

References

Check your stack JSON