4.7

CVE-2026-112935: tox-dev filelock

CVSS: 4.7v3.1MediumUndergoing analysis
AliasesDEBIAN-CVE-2026-112935
Published 20-10-2026Last modified 20-10-2026
Open JSON

Vulnerability summary

CVE-2026-112935 is a medium (CVSS 4.7) vulnerability in tox-dev filelock.

Overall risk
19/100
0100
Low · default modelHow is this calculated?
CVSS score
4.7/10
010
Medium · v3.1 (CVE.org)
EPSS score
Not scored
0%100%
No EPSS score yet
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 20-10-2026
    PublishedVulnerability first disclosed.

Description

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its own marker following the stale read, an honest contender creates a live successor on the reused inode, and the successor's modification time is not newer than the saved observation, causing the live marker to be removed and two holders to be admitted. This issue is fixed in version 4.2.1.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Debian1 product
  • python-filelockAll versions (No fix recorded)
Tox-dev1 product

2 vendors · 2 products

References

5 links