Log in Start free

Vulnerability · Published Oct 29, 2026 · Assigned by PSF

CVE-2026-116566socket.getaddrinfo() accepts embedded null bytes in host and port

Medium 5.3

In plain English

A medium-severity security flaw in CPython from Python Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 4.0)5.3Medium
Exploit odds (30 days)0.3%top 82.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12python3.11no fix listedDEBIAN-CVE-2026-116566
Debian:13python3.13no fix listedDEBIAN-CVE-2026-116566
Debian:14python3.14no fix listedDEBIAN-CVE-2026-116566
Debian:14python3.15no fix listedDEBIAN-CVE-2026-116566
Ubuntu:22.04:LTSpython3.10no fix listedUBUNTU-CVE-2026-116566
Ubuntu:24.04:LTSpython3.12no fix listedUBUNTU-CVE-2026-116566
Ubuntu:26.04:LTSpython3.14no fix listedUBUNTU-CVE-2026-116566
Ubuntu:26.10python3.14no fix listedUBUNTU-CVE-2026-116566
Ubuntu:26.10python3.15no fix listedUBUNTU-CVE-2026-116566

Affected products (as reported)

VendorProductVersions
Python Software Foundation CPython 0 – before 3.16.0

Weakness: CWE-158 · Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References