---
id: CVE-2026-116566
title: socket.getaddrinfo() accepts embedded null bytes in host and port
summary: >-
  socket.getaddrinfo() previously accepted null bytes within *host* and *port*
  parameters which can cause the values to be silently truncated.
severity: medium
cvss: 5.3
cvssVector: 'CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-158
vendor: Python Software Foundation
product: CPython
affected:
  - CPython < 3.16.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-30T17:18:00.445284Z'
published: '2026-10-29'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T17:18:15.574Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116566'
references:
  - url: 'https://github.com/python/cpython/pull/160899'
  - url: 'https://github.com/python/cpython/issues/160898'
  - url: >-
      https://mail.python.org/archives/list/security-announce@python.org/thread/HCHE62VYTPYI6WOPJQDWUBR4CINBPSM7/
  - url: >-
      https://github.com/python/cpython/commit/131a3a66c5f400b588f9fd2732a5ed4e89623ee3
tags:
  - cve.org
epss: 0.00259
epssPercentile: 0.17723
ingestedAt: '2026-11-05T16:24:31.156Z'
---

## Overview

socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated.

## Affected

- `CPython < 3.16.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.