CVE-2026-116566— socket.getaddrinfo() accepts embedded null bytes in host and port

Quick assessment

Copy summary Copy citation

Affected

Python Software Foundation CPython

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

此前允许在 和 参数中包含空字节（null bytes），这会导致相关值被静默截断。

CVE-2026-116566 affects Python Software Foundation CPython. No confirmed in-the-wild exploitation; assess based on exposure. 此前允许在 和 参数中包含空字节（null bytes），这会导致相关值被静默截断。 CVE-2026-116566 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2026-116566

I. Basic Information for CVE-2026-116566

Affected Products

II. Public POCs for CVE-2026-116566

III. Intelligence Information for CVE-2026-116566

Other References for CVE-2026-116566 (3)

• Null bytes are accepted within `socket.getaddrinfo()` · Issue #160898 · python/cpython issue-tracking
• gh-160898: Reject null bytes in `socket.getaddrinfo()` host and port by sethmlarson · Pull Request #160899 · python/cpython patch
• Mailman 3 [CVE-2026-116566] socket.getaddrinfo() accepts embedded null bytes in host and port - Security-announce - python.org vendor-advisory

• https://www.cve.org/CVERecord?id=CVE-2026-116566

IV. Related Vulnerabilities