CVE-2026-112915Medium· 5.5▾ TwilightPoC availableA flaw was found in filelock. When utilizing the ReadWriteLock mechanism, the library attempts to open an SQLite database without properly restricting schema and query operations. A local attacker able to replace the lock database can prov…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 30.3 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the vendor's CSAF advisory record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 22.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
Exploit / PoC code exists
Last analysed / modified upstream
0.2%
0.2% → 0.2%
A flaw was found in filelock. When utilizing the ReadWriteLock mechanism, the library attempts to open an SQLite database without properly restricting schema and query operations. A local attacker able to replace the lock database can provide a specially crafted file that causes lock acquisition to stall or hang indefinitely. This failure leads to a Denial of Service (DoS) for applications depending on the lock.
filelock: filelock: Denial of Service via crafted SQLite lock database — rated Moderate by Red Hat. Released 2026-10-20, updated 2026-10-21.
Affected:
No fix planned:
Out of support scope
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-96640High· 7.5pillow: pillow: Denial of Service via duplicate page references in PDF files (CVE-2026-96640)
CVE-2026-111066High· 7.5aiohttp: aiohttp: Denial of Service via file descriptor exhaustion in multipart request processing (CVE-2026-111066)
CVE-2026-68498High· 7.5com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via excessively long JSON propert…
CVE-2026-67318Medium· 5.3axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2
CVE-2026-56816High· 7.5io.netty:netty-codec-http3: Netty: Denial of Service due to uncontrolled memory buffering in HTTP/3 (CVE-2026-56816)
CVE-2026-116141Medium· 5.3ImageMagick: ImageMagick: Denial of Service via policy bypass in UHDR decoder (CVE-2026-116141)