{"id":"ghsa-ghsa-cwqr-hh33-gh44","seq":2056948,"kind":"advisory","title":"filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout","url":"https://github.com/advisories/GHSA-cwqr-hh33-gh44","permalink":"https://vulnpulse.app/items/ghsa-ghsa-cwqr-hh33-gh44","summary":"影響: pip:filelock >= 3.20.4, <= 4.2.0 → 4.2.1\nReadWriteLock and AsyncReadWriteLock (the SQLite-backed reader/writer lock) run PRAGMA journal_mode=MEMORY on a fresh connection for every acquire. That statement makes SQLite load the whole schema (the sqlite_master table, which lists every table and index with its CREATE text) of whatever file sits at the lock path. The caller's timeout reaches SQLite only as busy_timeout, which bounds waits for another connection's lock, not schema loading. The only content checks reject non-regular files an…","severity":"medium","techs":["python","sqlite"],"cves":["CVE-2026-112915"],"tags":["GHSA-cwqr-hh33-gh44","filelock"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:08:49.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}