AZL-111542: CVE-2026-116566 affecting package python3 3.12.16-1

Q: What input conditions are required to trigger the issue?

An application must pass a host or port value containing a null byte to socket.getaddrinfo(). The vulnerable behavior silently truncates the value at the null byte.

Q: How can I identify potentially affected code paths?

Review uses of socket.getaddrinfo() that accept hostnames or port values from external or insufficiently validated input. Pay particular attention to code that relies on the complete supplied value for validation, authorization, logging, or destination restrictions.

Published Oct 29, 2026

Updated

socket.getaddrinfo() previously accepted null bytes within host and port parameters which can cause the values to be silently truncated.

Affected Software

1 affected component

azure-linux/python3<=3.12.16-1

Event History

Oct 29, 2026

Advisory Published

via OSV·06:17 PM

Data Sourced

via OSV·06:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-116566

Frequently Asked Questions

What input conditions are required to trigger the issue?

An application must pass a host or port value containing a null byte to socket.getaddrinfo(). The vulnerable behavior silently truncates the value at the null byte.

How can I identify potentially affected code paths?

Review uses of socket.getaddrinfo() that accept hostnames or port values from external or insufficiently validated input. Pay particular attention to code that relies on the complete supplied value for validation, authorization, logging, or destination restrictions.

AZL-111542: CVE-2026-116566 affecting package python3 3.12.16-1

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What input conditions are required to trigger the issue?

How can I identify potentially affected code paths?

Company

Resources

Contact

Frequently Asked Questions

What input conditions are required to trigger the issue?

How can I identify potentially affected code paths?