CPython getaddrinfo accepts embedded null bytes (CVE-2026-116566)
Original title: CPython [CVE-2026-116566] socket.getaddrinfo() accepts embedded null bytes in host and port
Python's security list rates the socket.getaddrinfo host and port flaw medium; the notice is truncated.
A Python security announcement, forwarded on oss-security by Alan Coopersmith, describes a medium-severity CPython flaw tracked as CVE-2026-116566. socket.getaddrinfo() previously accepted embedded null bytes in the host and port. The available text cuts off before affected versions, a fix, or exploitation status.
Unconfirmed: Affected versions, the fix, and whether the flaw is exploited are not in the snippet.
- Seth Larson sent the notice to security-announce on October 29, 2026.
- The flaw is rated medium by the Python security announcement.
- No fixed release is included in the forwarded snippet.
Impact: getaddrinfo accepted embedded null bytes in host and port
| Product | Affected |
|---|---|
| CPython | — |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-116566 | Null-byte truncation in CPython socket.getaddrinfo() | 5.3 | — |
From the original article
Posted by Alan Coopersmith on Oct 29 -------- Forwarded Message -------- Subject: [Security-announce][CVE-2026-116566] socket. getaddrinfo() accepts embedded null bytes in host and port Date: Thu, 29 Oct 2026 17:46:30 +0000 From: Seth Larson Reply-To: security-sig () python org To: security-announce () python org There is a MEDIUM severity vulnerability affecting CPython. socket.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.