CVE-2026-112907: filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break

CVE-2026-112907 · Severity: low · CVSS 3.1 · Published 2026-11-05

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, soft lock classes on Windows read an existing marker with _read_lock_file and remove a stale marker through break_lock_file using pathname operations that wait for an oplock break. Another local account with read access to an unheld marker can keep a Level 1 or batch oplock unanswered, causing SoftFileLock.acquire and related async or fallback locks to wait beyond timeout, blocking=False, and cancel_check. A stale marker under the oplock cannot be broken, but mutual exclusion remains intact and no file other than the marker is accessed. This issue is fixed in version 4.2.1.

Technologies: filelock (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-112907 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-112907 being exploited in the wild.
How severe is CVE-2026-112907?
Low severity, with a CVSS score of 3.1, published 5 November 2026.
Which products and versions are affected?
filelock (PyPI) >= 3.22.0, <= 4.2.0, ECOSYSTEM:introduced=3.22.0,fixed=4.2.1.
Is there a fix for CVE-2026-112907?
Yes. filelock (PyPI): upgrade to 4.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2026-112907?
Check whether you run filelock (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • filelock (PyPI): upgrade to 4.2.1 or later
    pip install "filelock>=4.2.1"

Affected products

  • filelock (PyPI) >= 3.22.0, <= 4.2.0, ECOSYSTEM:introduced=3.22.0,fixed=4.2.1

Identifiers

  • CVE-2026-112907
  • GHSA-567q-5qvw-pf92

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.