---
id: "CVE-2026-116566"
kind: "vulnerability"
aliases: ["CVE-2026-116566"]
title: "Python: socket.getaddrinfo silently truncates host and port with null bytes"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["python", "runtime", "server-side"]
not_affected_if: ["no-untrusted-host-input"]
published_at: "2026-10-29T18:17:24+00:00"
first_seen_at: "2026-10-29T18:26:33+00:00"
updated_at: "2026-10-29T18:28:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116566", "first_seen_at": "2026-10-29T18:26:33+00:00"}]
---

# Python: socket.getaddrinfo silently truncates host and port with null bytes

Python's socket.getaddrinfo() accepted null bytes inside the host and port arguments, which could cause those values to be silently cut short. The sources do not state what an attacker can do with a truncated hostname or port.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Python version with `python3 --version` and compare it against the fixed releases in the Python security announcement.
- Look for code that passes untrusted input into socket.getaddrinfo() or socket.create_connection().

## Timeline

- 2026-10-29T18:26:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116566

## Documents

- [advisory] Python security-announce: [Security-announce][CVE-2026-116566] socket.getaddrinfo() accepts embedded null bytes in host and port https://mail.python.org/archives/list/security-announce@python.org/message/HCHE62VYTPYI6WOPJQDWUBR4CINBPSM7/

## From the sources

socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_