CVE-2026-112915

Published: Oct 20, 2026Modified: Oct 21, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock can open a crafted SQLite lock database without bounding schema and query work, allowing another local user who can replace the database to make acquisition stall or hang; versions from 3.20.4 expose this on initial per-instance opening, and versions from 3.30.0 repeat the exposure on every acquisition. This issue is fixed in version 4.2.1.

Affected (1)

Products: Tox Dev: Filelock

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Tox Dev Filelock	3.20.4 ≤ version < 4.2.1

Related CWEs

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (5)

https://github.com/tox-dev/filelock/commit/5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d

Source: security-advisories@github.com

Patch

https://github.com/tox-dev/filelock/pull/834

Source: security-advisories@github.com

Patch

https://github.com/tox-dev/filelock/releases/tag/4.2.1

Source: security-advisories@github.com

Release Notes

https://github.com/tox-dev/filelock/security/advisories/GHSA-cwqr-hh33-gh44

Source: security-advisories@github.com

ExploitMitigationPatchVendor Advisory

https://github.com/tox-dev/filelock/security/advisories/GHSA-cwqr-hh33-gh44

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitMitigationPatchVendor Advisory

Timeline

No history available yet.