CVE-2026-112906

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can reuse a stale observation when an attacker pre-dates and removes its own marker, at least two lock-user processes are waiting, coarse or matching modification times preserve the observation, and an honest contender creates a fresh marker on the reused inode, causing that live marker to be removed as stale. This issue is fixed in version 4.2.1.

• CWE-694

• https://github.com/tox-dev/filelock/commit/740ff666b62a88496c8d7394e4e6230605e4d62b
• https://github.com/tox-dev/filelock/releases/tag/4.2.1
• https://github.com/tox-dev/filelock/security/advisories/GHSA-2g95-wg33-c5x2
• https://github.com/tox-dev/filelock/security/advisories/GHSA-2g95-wg33-c5x2

Published

Oct 20, 2026

Last Modified

Oct 20, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-112897Pillow is a Python imaging library. From 5.3.0 until 13.0.0,…8.7
• CVE-2026-112898Pillow is a Python imaging library. From 9.1.0 until 13.0.0,…6.9
• CVE-2026-1129A vulnerability was detected in Yonyou KSOA 9.0. This vulner…9.8
• CVE-2026-11290Integer overflow in WebView in Google Chrome on Android prio…5
• CVE-2026-112900Pillow is a Python imaging library. From 2.6.0 until 13.0.0,…9.2
• CVE-2026-112901Pillow is a Python imaging library. Prior to 13.0.0, Pillow'…6.9
• CVE-2026-112909filelock is a platform-independent file lock for Python. Pri…6.1
• CVE-2026-11291Inappropriate implementation in Android Autofill in Google C…4.3
• CVE-2026-112911filelock is a platform-independent file lock for Python. Fro…6.3
• CVE-2026-112912filelock is a platform-independent file lock for Python. Fro…2.5
• CVE-2026-112914filelock is a platform-independent file lock for Python. Fro…5.3
• CVE-2026-112915filelock is a platform-independent file lock for Python. Fro…5.5