Live › vulnerability › CVE-2026-116566
Python's socket.getaddrinfo() accepted null bytes inside the host and port arguments, which could cause those values to be silently cut short. The sources do not state what an attacker can do with a truncated hostname or port.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 18:26 UTC. All times on this page are UTC.
Applications running a Python interpreter that passes externally supplied strings to socket.getaddrinfo(). The sources do not name affected version ranges or the exact consequence of truncation. Teams that only run fixed-input code paths are unlikely to be exposed.
No product ranges from the sources yet.
python3 --version and compare it against the fixed releases in the Python security announcement.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
socket.getaddrinfo() previously accepted null bytes within host and port parameters which can cause the values to be silently truncated.
This page as .md · .json · in your agent: get_signal("CVE-2026-116566")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.