CVE-2026-112935

mediumpriority · track · 0EPSS 0.001 · 3 %ileUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.13% (3rd) EPSS

CVSS 4.7 · medium

Is it mine?

1 products

Check your exposure

Who says so?

1 sources

nvd

EPSS · scored 2026-10-28

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its own marker following the stale read, an honest contender creates a live successor on the reused inode, and the successor's modification time is not newer than the saved observation, causing the live marker to be removed and two holders to be admitted. This issue is fixed in version 4.2.1.

01

cvss

Technical severity, 0–10. One row per scoring source.

4.7

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.14.7mediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:Nsecondary · security-advisories@github.comexploitability 1 · impact 3.6

v3.14.3mediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

02

weaknesses

The CWE weakness classes this flaw belongs to.

03

affected products (1)

Products and version ranges known to be affected.

tox-dev filelock3.22.0 → 4.2.1nvdUScpe:2.3:a:tox-dev:filelock:*:*:*:*:*:*:*:*

04

sources

Which sources assert this record, and when.

nvd NVD CVE.org MITRE

published 2026-10-20modified 2026-10-28

05

references (4) nvd

External citations — patches, advisories, analysis.

https://github.com/tox-dev/filelock/commit/740ff666b62a88496c8d7394e4e6230605e4d62bPatch
https://github.com/tox-dev/filelock/pull/843Patch
https://github.com/tox-dev/filelock/releases/tag/4.2.1Release Notes
https://github.com/tox-dev/filelock/security/advisories/GHSA-fq56-3cx3-fjxpExploitMitigationPatchVendor Advisory

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.