CPython [CVE-2026-116566] socket.getaddrinfo() accepts embedded null bytes in host and port

As cited

Copy frozen at 2026-10-29 19:39 UTC (site build).

vulnerabilities

CPython [CVE-2026-116566] socket.getaddrinfo() accepts embedded null bytes in host and port

CPython's socket.getaddrinfo() function accepts embedded null bytes in host and port arguments, creating a medium severity vulnerability. The issue was disclosed October 29, 2026.

Why it matters: Python application developers must patch CPython to prevent null byte injection attacks that could bypass hostname validation or cause unexpected behavior in network code.

Source published

2026-10-29 17:58 UTC

First seen by Cybersecurity Tracker

2026-10-29 19:01 UTC