MediumVulnerabilityCVE-2026-112934updated 28 Oct 2026, 21:08 UTC

filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user…

Fixed in filelock 4.2.1Official source

Severity	MediumCVSS 6.1 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	Yesfilelock 4.2.1 · since 28 Oct 2026
How sure is this?	Official sourceBacked by an official source

Are you affected?

Package / product	Affected versions	Fixed in
filelock · pip	>= 4.0.0, <= 4.2.0	4.2.1

Timeline

28 Oct 2026, 21:08 UTC
Publicly disclosed
28 Oct 2026, 21:08 UTC
Reported by GitHub Advisory · GitHub Advisory
28 Oct 2026, 21:08 UTC
Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its recordGitHub Advisory · 28 Oct 2026, 21:08 UTC

Technical details

ID: CVE-2026-112934 · GHSA-fj95-fr6c-h845
CVSS: 6.1 / 10
EPSS: 0.2% chance of exploitation within 30 days
Disclosed: 28 Oct 2026, 21:08 UTC
On Zero Radar: 28 Oct 2026, 21:08 UTC (0 min after disclosure)
Last change: 28 Oct 2026, 21:08 UTC

This entry has not been explained yet. The text comes straight from the source. How Zero Radar works

filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user… · Zero Radar