CVE-2026-116566: socket.getaddrinfo() accepts embedded null bytes in host and port
socket.getaddrinfo() previously accepted null bytes within host and port parameters which can cause the values to be silently truncated.
Event History
Frequently Asked Questions
What conditions are required to exploit this issue?
An attacker must be able to influence a host or port value passed to socket.getaddrinfo(), including supplying an embedded null byte. The vulnerable call then silently truncates the value at the null byte.
Who is most likely to be exposed?
Applications that pass attacker-controlled hostnames or port values to socket.getaddrinfo() are the relevant exposure. The supplied data does not identify particular products, deployments, or default configurations as affected.
How can I determine whether my application may be affected?
Review uses of socket.getaddrinfo() and trace whether the host or port arguments can contain untrusted input. Inputs containing embedded null bytes are the specific condition to test for, because they may be resolved using only the portion before the null byte.