{"id":"ghsa-ghsa-567q-5qvw-pf92","seq":661279,"kind":"advisory","title":"filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break","url":"https://github.com/advisories/GHSA-567q-5qvw-pf92","permalink":"https://vulnpulse.app/items/ghsa-ghsa-567q-5qvw-pf92","summary":"影響: pip:filelock >= 3.22.0, <= 4.2.0 → 4.2.1\nOn Windows the soft locks (SoftFileLock, MarkerSoftFileLock, SoftFileLease, their async forms, and a FileLock that fell back to a soft lock) read their marker by path. The marker is the lock file whose presence says a process holds the lock. Each acquire() attempt that finds a marker opens it with os.open to read the holder's process id, and the lock renames and deletes a marker it judges stale, by path. On Windows each of these calls waits for an oplock. An oplock (opportunistic lock) is a req…","severity":"low","techs":["python"],"cves":["CVE-2026-112907"],"tags":["GHSA-567q-5qvw-pf92","filelock"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T22:27:32.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}