CPython CVE-2026-116566: getaddrinfo() accepts embedded null bytes in host and port

What happened and what to do

The advisory, issued by the Python security team and relayed on the oss-sec list by Alan Coopersmith, covers a medium-severity vulnerability in CPython identified as CVE-2026-116566. According to the text, socket.getaddrinfo() previously accepted null bytes within the host and port parameters. The publication date is 29 October 2026, and the advisory was signed by Seth Larson.

In practice, a company should start with an inventory of every service and pipeline that runs Python and performs name resolution with values coming from outside, such as URLs, configuration, message queues or forms. It should then plan the upgrade to a fixed CPython release and, before the socket call, validate that host and port contain no null bytes and match the expected format. Rejections of such inputs should also be logged, so that exploitation attempts can be detected and the effect of the fix can be measured. A project like this combines a review of the software estate, automated tests and a simple dashboard to track rollout.

How the consultancy can help

We can diagnose where CPython runs in your organisation and which code paths pass external values into socket.getaddrinfo(). We then implement the upgrade plan, input validation and rejection monitoring, and operate the solution with ongoing follow-up.

Next step

If your team runs Python in production, send a short description of your environment and the points where external data enters. We will reply with a scoped proposal for diagnosis and remediation.