AIKIDO-2026-499176
filelock is vulnerable to Denial of Service (DoS)
55
Medium Risk
This Affects:
filelockTL;DR
The SoftFileLease marker parser in _build_record reads a lease duration with float() and only rejects values that are non-positive, so a non-finite nan or inf duration passes as a valid lease record. A peer that can write to the shared lock filesystem plants a marker carrying duration=nan, which every contender then reads as a live claim. Because nan never equals any configured lease duration, each contender raises LeaseSettingsMismatch and the malformed marker is never reclaimed, wedging lock acquisition on that path. The fix rejects non-finite lease durations so such a marker is treated as malformed and ages out through the grace window instead.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and use lease-based soft locks (SoftFileLease) on a filesystem that other parties can write to.
Background info
filelock is vulnerable to Denial of Service (DoS) in versions 3.30.0 - 3.30.0.
How to fix this
Upgrade the filelock library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant