CVE-2026-114605 is a vulnerability in bbot's use of dnspython where the dns.name.from_wire_parser() function can be triggered to consume excessive CPU resources when processing maliciously crafted DNS messages. This can degrade application performance or cause denial of service (DoS) in applications handling untrusted DNS wire format messages. The issue is fixed in dnspython version 2.9.0. No workarounds are currently known.
The filelock ReadWriteLock and AsyncReadWriteLock components use SQLite databases for locking, but on Linux, SQLite reopens the lock database by name via /proc/self/fd, following symlinks and acting on side files like -journal, -wal, and -shm. This behavior allows a local attacker who can create or rename files in the directory containing the lock database (if it is writable without the sticky bit) to manipulate the lock user's files by planting symlinks or journal files. This can lead to arbitrary file writes, file creation or deletion, and denial of lock acquisition, all with the lock user's privileges. The vulnerability affects filelock versions 3.20.4 through 4.2.0, with the fixed version being 3.0.2_3. The CVSS 3.1 score is 7.1 (High).
A vulnerability in the filelock library versions 3.22.0 through 4.2.0 allows a local user with write access to a lock marker file (but not removal rights) to forge the process ID in the marker. This causes another process, running as the lock owner or root, to mistakenly consider the lock stale and remove the live marker, resulting in two processes concurrently holding the lock. This can lead to integrity violations where both processes write to the protected resource without error.
A vulnerability in filelock versions 3.30.0 through 4.2.0 allows a local user with write access to a shared directory to swap a lock coordination directory for a symbolic link, causing the lock user to create claim files in an attacker-chosen directory. This can lead to denial of service by causing stranded claims that block other processes from acquiring the lock until manually force-broken. The attack requires a race condition and specific directory permissions but does not require user interaction.
The ReadWriteLock and AsyncReadWriteLock classes in bbot versions >=2.8.2 and <3.0.2_3 resolve lock paths following symlinks, allowing a local attacker with write access to the lock directory to manipulate lock files. This can cause the victim process to create files at unintended locations, break mutual exclusion by allowing multiple processes to hold the write lock simultaneously, and interfere with other applications' SQLite databases by causing lock contention.
A race condition vulnerability exists in filelock versions 3.22.0 through 4.2.0 involving the stale-lock break mechanism in SoftFileLock and related classes. This flaw allows two processes of the same user to simultaneously hold what should be an exclusive lock due to inode reuse on certain filesystems (ext4, xfs, overlayfs). A local unprivileged user who can create files in the lock directory (e.g., /tmp) can force this condition, causing the live lock file to be removed incorrectly and admitting multiple holders without detection. The issue impacts integrity but not confidentiality or availability.
CVE-2026-112934 is a medium-severity local vulnerability in filelock versions >=3.0.2_1 and <3.0.2_3. It involves the SoftReadWriteLock mechanism refreshing its holder record by reopening and writing to a file without verifying the file type beyond symbolic links. A local user who owns the lock's .rw directory can rename a FIFO (named pipe) or a hard link over the holder record file, causing the lock user's write operation to hang or overwrite part of a private file. This leads to a denial of service by stalling the lock holder's heartbeat and allowing multiple processes to believe they hold the lock simultaneously. The vulnerability requires local access and specific filesystem conditions, such as permissive hard-link policies on Linux or default macOS/BSD behavior. A fix is available in version 3.0.2_3.
A vulnerability in the filelock library's ReadWriteLock and AsyncReadWriteLock components allows a local user with write access to the lock database file path to cause every acquire operation to stall or hang indefinitely, ignoring timeout and non-blocking flags. This is achieved by placing a crafted SQLite database file at the lock path, which triggers extensive schema loading that blocks the lock acquisition. The issue affects filelock versions 3.20.4 through 4.2.0 and results in a denial of service condition without impacting confidentiality or integrity.
A symlink swap vulnerability in filelock's SoftFileLock writability check allows a local user to leak one bit of information about whether a path exists and is writable by the lock user. This occurs because the check uses os.lstat followed by os.access, which follows symlinks, enabling a time-of-check to time-of-use (TOCTOU) leak. The vulnerability affects filelock versions 3.32.6 through 4.2.0 and is mitigated by Linux kernel's fs.protected_symlinks setting in common sticky world-writable directories like /tmp. The impact is limited to leaking existence and writability of a path, with no integrity or availability effects. The vulnerability requires local access, high attack complexity, and observation of the lock user's acquire outcome.
CVE-2026-112911 affects the filelock library versions from 3.0.1 up to but not including 3.0.2_3. The vulnerability arises because StrictSoftFileLock and SoftReadWriteLock classes adopt an existing protocol directory without verifying ownership, allowing a local unprivileged user to pre-create this directory in shared sticky-bit directories like /tmp. This can lead to integrity and availability impacts, such as multiple writers entering critical sections simultaneously and denial of service by causing lock acquisition to spin indefinitely or consume excessive memory. The vulnerability requires local access and a race condition where the attacker creates the directory before the legitimate user first acquires the lock path. The CVSS 3.1 base score is 6.3 (Medium). A patch is available in version 3.0.2_3.
UnixFileLock, used by FileLock and AsyncFileLock on Unix systems, truncates and changes permissions of any regular file that another local user renames or hard-links onto the lock path before the lock user's next acquire. This can lead to unintended file truncation and permission changes, allowing the other user to read and modify the file contents thereafter. The vulnerability affects all filelock releases up to and including 4.2.0, with the chmod behavior introduced since version 3.10.2. Exploitation requires local user access and specific directory permissions or kernel settings. The issue is patched in version 3.0.2_3.
The vulnerability in filelock versions >=3.0.1 and <3.0.2_3 involves the creation of claim directories without applying the intended restrictive mode, allowing other local users with write permissions on the directory to unlink claim files. This can lead to multiple holders simultaneously writing protected data without detection, causing integrity issues. The flaw requires specific environmental conditions such as a permissive umask or default ACL granting write access to other users. The issue has been fixed in version 3.0.2_3.
A Regular Expression Denial of Service (ReDoS) vulnerability exists in soupsieve's CSS selector parsing, specifically in the IDENTIFIER and VALUE sub-patterns. The flaw arises from overlapping quantified character classes causing quadratic backtracking when parsing certain crafted selectors that fail to match, such as unterminated attribute values or invalid trailing characters. This can cause the interpreter to stall for seconds or minutes depending on input size. The vulnerability affects applications that accept user-controlled CSS selectors via soupsieve or BeautifulSoup's select methods. A fix is available in soupsieve version 3.0.1.
A regular expression denial of service (ReDoS) vulnerability exists in soupsieve's whitespace/comment trimming regex RE_WS_END, which is used to trim trailing whitespace and comments from CSS selectors. The regex is applied with an unanchored .search() call, causing quadratic time complexity (O(n²)) on valid selectors containing long runs of whitespace or comments not exactly at the string end. This can cause significant CPU delays (e.g., ~10 seconds for a 20 KB selector). The vulnerability affects soupsieve versions from 1.1.0.2090 up to but not including 3.0.1. A fix is available in version 3.0.1.
A Regular Expression Denial of Service (ReDoS) vulnerability exists in soupsieve's CSS selector parser due to a regex pattern that suffers catastrophic backtracking when processing attribute selectors with unterminated quoted values. This flaw allows an attacker to cause CPU exhaustion by supplying a crafted CSS selector string, leading to thread blocking and significant processing delays. The vulnerability affects soupsieve versions from 1.1.0.2090 up to but not including 2.8.4_6. A fix is available in version 2.8.4_6.
The soupsieve CSS selector parser used by Beautiful Soup 4 can be forced to allocate excessive memory when processing large comma-separated selector lists. An attacker supplying a crafted selector string to soupsieve.compile() or Beautiful Soup's select methods can cause memory exhaustion, leading to denial of service. This occurs because the parser creates a complex object for each selector without limiting the number of selectors. A 500 KB input string can cause allocation of approximately 244 MB of heap memory, a 488x amplification. This vulnerability affects versions >=1.1.0.2090 and <2.8.4_6 and has been fixed in version 2.8.4_6.
CVE-2026-22701 is a Time-of-Check-Time-of-Use (TOCTOU) race condition vulnerability in the SoftFileLock class of the filelock package used by the bbot product. The flaw allows a local attacker with permission to create symlinks to exploit a race window between permission checking and file creation, potentially causing lock acquisition to fail silently, leading to denial of service or unintended file operations. The vulnerability affects versions >=1.0.5.1665 and <2.7.2_5. A patch is available in version 2.7.2_5 that adds the O_NOFOLLOW flag to prevent symlink attacks on supported platforms. Users are advised to upgrade to the patched version or apply mitigations such as using alternative locking mechanisms or restricting filesystem permissions.
CVE-2025-68146 is a TOCTOU race condition vulnerability in the filelock library affecting Unix, Linux, macOS, and Windows. It allows local attackers with filesystem access and symlink creation capability to truncate arbitrary user files by exploiting a race window during lock file creation. The flaw impacts dependent projects like virtualenv, PyTorch, poetry, and tox. The issue is fixed in filelock version 3.20.1 by preventing symlink following during file open operations.
A vulnerability in orjson versions from 2.3.1 up to but not including 2.8.1 allows unlimited recursion when serializing deeply nested JSON documents using orjson.dumps. This flaw was fixed in version 2.8.1. The issue could lead to high-impact consequences due to uncontrolled recursion depth.
CVE-2025-58367 is a critical vulnerability in the DeepDiff Python library's Delta class that allows class pollution via its constructor. This flaw enables attackers to manipulate the internal allow list for safe deserialization, leading to insecure Pickle deserialization. Exploitation can result in Denial of Service, Remote Code Execution, and potentially other impacts such as authentication bypass in web applications. The vulnerability affects DeepDiff versions from 1.0.5.1665 up to but not including 2.6.1_1. A patch is available in version 2.6.1_1.