DEBIAN-CVE-2026-116566: Medium severity debian/python3.11 vulnerability

Published Oct 29, 2026

Updated

socket.getaddrinfo() previously accepted null bytes within host and port parameters which can cause the values to be silently truncated.

Affected Software

3 affected components

debian/python3.11*

debian/python3.13*

debian/python3.14*

Event History

Oct 29, 2026

CVE Published

via OSV·06:17 PM

Data Sourced

via OSV·06:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which Debian packages are identified as affected?

The affected software listed is Debian python3.11, python3.13, and python3.14.

What condition is required for the truncation issue to occur?

The host or port value passed to socket.getaddrinfo() must contain a null byte. The function can then silently truncate the value at that byte.

What security impact can result from this behavior?

Silent truncation of host or port values can cause socket.getaddrinfo() to resolve or connect using a different value than the caller intended. The provided severity information rates the issue medium, with high confidentiality and integrity impact.

DEBIAN-CVE-2026-116566: Medium severity debian/python3.11 vulnerability

Affected Software

Event History

Frequently Asked Questions

Which Debian packages are identified as affected?

What condition is required for the truncation issue to occur?

What security impact can result from this behavior?

Company

Resources

Contact

Frequently Asked Questions

Which Debian packages are identified as affected?

What condition is required for the truncation issue to occur?

What security impact can result from this behavior?