CVE-2026-116566

socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated.

CVSS 4.0

5.3CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CWE

CWE-158

Published

2026-10-29

Modified

2026-10-29

Record from

the NVD, synced 2026-10-29

References

• https://github.com/python/cpython/issues/160898
• https://github.com/python/cpython/pull/160899
• https://mail.python.org/archives/list/security-announce@python.org/thread/HCHE62VYTPYI6WOPJQDWUBR4CINBPSM7/

Check your stackJSON