CVE-2026-116566

Description

socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated.

References

• https://github.com/python/cpython/issues/160898
• https://github.com/python/cpython/pull/160899
• https://mail.python.org/archives/list/security-announce@python.org/thread/HCHE62VYTPYI6WOPJQDWUBR4CINBPSM7/
• http://www.openwall.com/lists/oss-security/2026/10/29/4