| filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lockCVE-2026-112941 · GHSA-WFHQ-Q4J2-C37M |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live holdCVE-2026-112908 · GHSA-6627-M3XW-93MP |
filelockExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACLCVE-2026-112910 · GHSA-8MX5-7M5M-R77G |
filelockRed Hat OpenShift AI (RHOAI)/rhoai/odh-mlflow-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusionCVE-2026-112911 · GHSA-9C4X-GM8V-WGC4 |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock takerCVE-2026-112912 · GHSA-9J6Q-WVJ5-JGJG |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable markerCVE-2026-112939 · GHSA-RFPC-QCW5-3PC4 |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user choosesCVE-2026-112938 · GHSA-M462-7RXW-WVPG |
filelock |
PyPI |
Medium
|
Fix reported |
|
| filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock pathCVE-2026-112909 · GHSA-69HJ-F68J-2879 |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeoutCVE-2026-112915 · GHSA-CWQR-HH33-GH44 |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its recordCVE-2026-112934 · GHSA-FJ95-FR6C-H845 |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holdersCVE-2026-112935 · GHSA-FQ56-3CX3-FJXP |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| filelock: ReadWriteLock follows a symlink at the lock path into SQLiteCVE-2026-112936 · GHSA-J8F7-RJXC-MR56 |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory nameCVE-2026-112937 · GHSA-JQC4-5CVW-7W85 |
filelock |
PyPI |
Medium
|
Fix reported |
|
| filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its databaseCVE-2026-112913 · GHSA-9VHV-JXWW-XFM5 |
filelockRed Hat OpenShift AI (RHOAI)/rhoai/odh-mlflow-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale breakCVE-2026-112907 · GHSA-567Q-5QVW-PF92 |
filelockRed Hat OpenShift AI (RHOAI)/rhoai/odh-mlflow-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directoryCVE-2026-112914 · GHSA-CRV4-6MHJ-J5JH |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own filesCVE-2026-112940 · GHSA-V4X8-3WR5-3WQ8 |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuseCVE-2026-112906 · GHSA-2G95-WG33-C5X2 |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLockCVE-2026-22701 · GHSA-QMGC-5H2G-MVRWVersion ranges need review. |
filelockMigration Toolkit for Containers/rhmtc/openshift-migration-hook-runner-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| filelock has a TOCTOU race condition which allows symlink attacks during lock file creationCVE-2025-68146 · GHSA-W853-JP5J-5J7FVersion ranges need review. |
filelockMigration Toolkit for Containers/rhmtc/openshift-migration-hook-runner-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
