Quick answers
- Is CVE-2026-116566 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-116566 being exploited in the wild.
- How severe is CVE-2026-116566?
- Informational severity, published 29 October 2026.
- Which products and versions are affected?
- Python CPython 3.11, 3.12, 3.13, 3.14, 3.15 and earlier.
- Is there a fix for CVE-2026-116566?
- A patch was published on 2026-10-29: Fix merged to main branch via PR #160899 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-116566 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-116566?
- Check whether you run Python CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The socket.getaddrinfo() function in CPython's socket module accepted null bytes (ASCII 0x00) in the host and port parameters, leading to silent truncation of these values at the null byte boundary. This is inconsistent with other socket APIs that reject null bytes. An attacker could exploit this by crafting hostnames or ports containing embedded nulls to bypass string-based hostname validation or cause unexpected address resolution behavior.
Affected products
- Python CPython 3.11, 3.12, 3.13, 3.14, 3.15 and earlier
Timeline
- 2026-10-29: disclosed
- 2026-10-29: patched: Fix merged to main branch via PR #160899