medium
advisory
CPython: socket.getaddrinfo() accepts embedded null bytes in host and port (CVE-2026-116566)
CPython socket.getaddrinfo() has been identified as accepting embedded null bytes in host and port parameters.
CVE search metadata
CVE search record: CVE-2026-116566. KEV: no. Product: CPython. Brief: CPython: socket.getaddrinfo() accepts embedded null bytes in host and port (CVE-2026-116566). Brief link: https://feed.craftedsignal.io/briefs/2026-10-cpython-null-byte-vulnerability/
Triage facts
Revision 1- Applicability
- CPython
- Evidence
- Unknown
- Severity
- Medium
- Sources
- 1 public source
- Freshness
- Revision 1Oct 29, 18:33 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
The Python Software Foundation has announced a medium-severity vulnerability (CVE-2026-116566) affecting CPython. The function socket.getaddrinfo() accepts embedded null bytes in host and port parameters.