Medium severity · published Oct 29, 2026
CVE-2026-116566
socket.getaddrinfo() accepts embedded null bytes in host and port
New
5.3
CVSS
–
EPSS
No
On KEV
Description
socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
CPython · Python Software Foundation
before 3.16.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116566
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116566
github.com
https://github.com/python/cpython/issues/160898
github.com
https://github.com/python/cpython/pull/160899
mail.python.org
https://mail.python.org/archives/list/security-announce@python.org/thread/HCHE62VYTPYI6WOPJQDWUBR4CINBPSM7/
More from CPython
9.4
CVE-2026-115557
Distrust compromised intermediate certificates in ssl module
9.4
CVE-2025-4517
Arbitrary writes via tarfile realpath overflow
9.2
CVE-2026-19445
Use-after-free of a server-side SSLContext when sni_callback switches contexts
8.8
CVE-2026-3298
Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes
8.7
CVE-2024-8088
Infinite loop when iterating over zip archive entry names from zipfile.Path