---
id: CVE-2026-112935
title: >-
  filelock: SoftFileLock stale-lock break removes a live lock file on a reused
  inode number and admits two holders
summary: >-
  filelock is a platform-independent file lock for Python. From 3.22.0 until
  4.2.1, SoftFileLock can break a stale marker after an attacker frees its own
  marker following the stale read, an honest contender creates a live successor
  on the …
severity: medium
cvss: 4.7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-367
vendor: tox-dev
product: filelock
affected:
  - 'filelock >= 3.22.0, < 4.2.1'
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T14:32:25.740Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112935'
references:
  - url: >-
      https://github.com/tox-dev/filelock/security/advisories/GHSA-fq56-3cx3-fjxp
    label: >-
      https://github.com/tox-dev/filelock/security/advisories/GHSA-fq56-3cx3-fjxp
  - url: 'https://github.com/tox-dev/filelock/pull/843'
    label: 'https://github.com/tox-dev/filelock/pull/843'
  - url: >-
      https://github.com/tox-dev/filelock/commit/740ff666b62a88496c8d7394e4e6230605e4d62b
    label: >-
      https://github.com/tox-dev/filelock/commit/740ff666b62a88496c8d7394e4e6230605e4d62b
  - url: 'https://github.com/tox-dev/filelock/releases/tag/4.2.1'
    label: 'https://github.com/tox-dev/filelock/releases/tag/4.2.1'
tags:
  - cve.org
ingestedAt: '2026-10-20T15:09:24.122Z'
---

## Overview

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its own marker following the stale read, an honest contender creates a live successor on the reused inode, and the successor's modification time is not newer than the saved observation, causing the live marker to be removed and two holders to be admitted. This issue is fixed in version 4.2.1.

## Affected

- `filelock >= 3.22.0, < 4.2.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.