filelock is a cross‑platform file‑locking library for Python. In versions 3.20.4 through 4.2.0 the ReadWriteLock implementation opens a SQLite file lock database without bounding its schema or query work. A crafted database allows a local user, who can replace the database file, to cause every acquire operation to stall or hang regardless of any timeout. The result is a denial of service when processes attempt to obtain a lock, leading to resource exhaustion or unresponsive applications. This issue is fixed in version 4.2.1.

The vulnerable product is the tox‑dev filelock library used in Python projects. All releases from 3.20.4 through 4.2.0 are affected. The issue is fixed in version 4.2.1. The vulnerability applies to any platform where the library is used since it relies on SQLite, and affects both local users and services running with elevated privileges that can write the lock database.

The CVSS base score is 5.5, indicating moderate severity. The EPSS score is 0.00218. The vulnerability is not listed in the CISA KEV catalog. The attack requires local user access to the directory holding the lock database. A local attacker who can replace the SQLite file can trigger a lock acquisition stall, making the affected process hang. Because the attack is local, the risk is limited to environments where the application runs with write access to the lock directory or where a malicious user can influence that path.