Denial of Service in filelock Python Library

Executive Summary

CVE-2026-112915 affects the filelock Python library's ReadWriteLock feature, which uses SQLite for locking mechanisms. The vulnerability allows a crafted SQLite lock database to cause indefinite hangs during lock acquisition by forcing SQLite to load large schemas or spin CPU indefinitely. This occurs because the library reopens the database connection on every acquire, making timeout settings ineffective. The issue impacts versions 3.20.4 through 4.2.0.

Useful 0 Not Useful 0

Detection Guidance

Check filelock library version with pip show filelock. If version is between 3.20.4 and 4.2.0, the system is vulnerable. Monitor for unusual lock acquisition hangs or high CPU usage during file operations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause denial of service by stalling or hanging lock acquisition indefinitely. An attacker with local access could exploit it to prevent applications from acquiring file locks, disrupting normal operations. It does not directly expose data but may lead to system unavailability or forced termination of affected processes.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade filelock to version 4.2.1 or later using pip install --upgrade filelock. Ensure lock directories are not writable by untrusted users. Restrict access to directories containing lock files.

Useful 0 Not Useful 0