CVE-2026-112915 PUBLISHED

filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout

Assigner: GitHub_M
Reserved: 19.10.2026 Published: 20.10.2026 Updated: 20.10.2026

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock can open a crafted SQLite lock database without bounding schema and query work, allowing another local user who can replace the database to make acquisition stall or hang; versions from 3.20.4 expose this on initial per-instance opening, and versions from 3.30.0 repeat the exposure on every acquisition. This issue is fixed in version 4.2.1.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 5.5

Product Status

Vendor tox-dev
Product filelock
Versions
  • Version >= 3.20.4, < 4.2.1 is affected

References

Problem Types

  • CWE-400: Uncontrolled Resource Consumption CWE