AZL-110070

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-110070.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-110070

Upstream

CVE-2026-112935

Published

2026-10-20T15:17:16Z

Modified

2026-10-23T14:16:37Z

Summary

CVE-2026-112935 affecting package python-filelock 3.20.3-3

Details

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its own marker following the stale read, an honest contender creates a live successor on the reused inode, and the successor's modification time is not newer than the saved observation, causing the live marker to be removed and two holders to be admitted. This issue is fixed in version 4.2.1.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-112935

Affected packages

Azure Linux:3 / python-filelock

Package

Name: python-filelock
Purl: pkg:rpm/azure-linux/python-filelock

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

3.20.3-3

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-110070.json"