CVE-2026-112915

Affected versions of the `filelock` package are vulnerable to Allocation of Resources Without Limits or Throttling due to opening a SQLite lock database without bounding schema and query work. `ReadWriteLock` opens its SQLite database without limiting the work a crafted schema or query can force, on the first opening of each instance from 3.20.4 and on every acquisition from 3.30.0. A local attacker who can replace the lock database with a crafted file can make lock acquisition stall or hang, blocking every process that relies on the lock.