AZL-110067

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-110067.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-110067

Upstream

CVE-2026-112909

Published

2026-10-20T15:17:15Z

Modified

2026-10-23T14:16:37Z

Summary

CVE-2026-112909 affecting package python-filelock 3.20.3-3

Details

filelock is a platform-independent file lock for Python. Prior to 4.2.1, UnixFileLock can truncate a regular file renamed onto the lock path when another local user has actual rename permission, or hard-linked there under a permissive hard-link policy; when an explicit mode is requested, affected versions from 3.10.2 can also change that file's mode. This issue is fixed in version 4.2.1.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-112909

Affected packages

Azure Linux:3 / python-filelock

Package

Name: python-filelock
Purl: pkg:rpm/azure-linux/python-filelock

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

3.20.3-3

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-110067.json"