Vulnerability in Python Software Foundation CPython

[ Description ]Official description

socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated.

[ Fixes ]Fixes and patches

• Security bulletin: Python HCHE62VYTPYI6WOPJQDWUBR4CINBPSM7Vendor patch or bulletin · CERT-FR · mail.python.org/archives/list/security-announce@python.org/thread/HCHE, cited by CERT-FR CERTFR-2026-AVI-1423

[ Advisories ]Government CERT advisories

• CERT-FR30 Oct 2026CERTFR-2026-AVI-1423

  Vulnerability in CPython Translated from French

  A vulnerability has been discovered in CPython. It allows an attacker to cause a security problem not specified by the vendor.

  CVE-2026-116566

[ References ]References

• github.com/python/cpython/commit/131a3a66c5f400b588f9fd2732a5ed4e89623ee3
• github.com/python/cpython/issues/160898
• github.com/python/cpython/pull/160899
• mail.python.org/archives/list/security-announce@python.org/thread/HCHE62VYTPYI6WOPJQDWU…
• www.openwall.com/lists/oss-security/2026/10/29/4