CVE-2026-116566Medium· 5.3▾ Sunlitsocket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
socket.getaddrinfo() previously accepted null bytes within host and port parameters which can cause the values to be silently truncated.
CPython < 3.16.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-119170High· 8.2Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10
CVE-2024-9287Medium· 5.3Virtual environment (venv) activation scripts don't quote paths
CVE-2026-103995Low· 2.0Lenient parsing of integers for response body and chunk framing
CVE-2026-115557Critical· 9.4Distrust compromised intermediate certificates in ssl module
CVE-2026-114583Medium· 6.9tar filter allows writing outside destination via empty-named symlink
CVE-2024-3220Low· 2.3There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users can create invalid files to cause MemoryError to be raised on Python runtime …