Threats tagged 'brew-poetry-cve-2026-112911'

A vulnerability in the filelock library versions 3.30.0 through 4.2.0 allows a local unprivileged user to pre-create a protocol directory used by StrictSoftFileLock and SoftReadWriteLock. This causes the lock to adopt a directory owned by the attacker, enabling them to interfere with lock claims, potentially allowing concurrent writers and denial of service conditions. The flaw requires the attacker to create the directory before the lock user's first acquire on that path, typically in shared sticky directories like /tmp. The vulnerability has a medium CVSS score of 6.3 and impacts integrity and availability but not confidentiality. A fix is available in version 2.5.1_1.