filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout

影響: pip:filelock >= 3.20.4, <= 4.2.0 → 4.2.1

ReadWriteLock and AsyncReadWriteLock (the SQLite-backed reader/writer lock) run PRAGMA journal_mode=MEMORY on a fresh connection for every acquire. That statement makes SQLite load the whole schema (the sqlite_master table, which lists every table and index with its CREATE text) of whatever file sits at the lock path. The caller's timeout reaches SQLite only as busy_timeout, which bounds waits for another connection's lock, not schema loading. The only content checks reject non-regular files an…

GitHub Advisory Database에서 읽기

2026. 10. 29. 오전 06:08, GitHub Advisory Database에서 "filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Python, SQLite. CVE: CVE-2026-112915.