Cyber ·
CPython CVE-2026-116566: socket.getaddrinfo() accepts embedded null bytes in host and port
Medium-severity security notice for CPython: socket.getaddrinfo() previously accepted null bytes inside the host and port arguments. Published on 29 October 2026 on the oss-sec list, relaying the Python security team's announcement.
On 29 October 2026, CVE-2026-116566 was disclosed, a medium-severity vulnerability affecting CPython. According to the notice, socket.getaddrinfo() previously accepted null bytes embedded in the host and port arguments. The disclosed text describes the behavior, but the available excerpt does not state the affected versions, the exact impact or the fixed version.
The notice was forwarded through the Python security announcement list and relayed to the oss-sec list as an automatic translation. To check whether your environment is affected, consult the original text and the official CVE record, which should list affected versions and fixes. Do not treat this summary as a complete source of version or mitigation details.
Rota Nacional does not patch third-party libraries or the Python interpreter in your infrastructure, and this notice does not describe a platform feature. If your organization runs CPython on servers, containers or applications, the practical action is to check the installed version, apply the official update recommended by the vendor, and review entry points that receive host and port values from external sources.