CVE-2026-116566
socket.getaddrinfo() accepts embedded null bytes in host and port
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated.
| CWE | CWE-158 |
| Vendor | python software foundation |
| Product | cpython |
| Published | Oct 29, 2026 |
| Last Updated | Oct 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for python software foundation cpython
Be the first to know when new unknown vulnerabilities affecting python software foundation cpython are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Python Software Foundation / CPython
0 < 3.16.0
References
github.com: https://github.com/python/cpython/pull/160899 github.com: https://github.com/python/cpython/issues/160898 mail.python.org: https://mail.python.org/archives/list/[email protected]/thread/HCHE62VYTPYI6WOPJQDWUBR4CINBPSM7/ github.com: https://github.com/python/cpython/commit/131a3a66c5f400b588f9fd2732a5ed4e89623ee3 openwall.com: http://www.openwall.com/lists/oss-security/2026/10/29/4
Credits
🔍 Venukamatchi (https://github.com/Venukamatchi) Seth Larson (https://github.com/sethmlarson) Gregory P. Smith (https://github.com/gpshead) Stan Ulbrych (https://github.com/StanFromIreland)