PSF-2026-48: socket.getaddrinfo() accepts embedded null bytes in host and port
Published Oct 29, 2026
·Updated
socket.getaddrinfo() previously accepted null bytes within host and port parameters which can cause the values to be silently truncated.
Event History
Oct 29, 2026
CVE Published
via OSV·05:45 PM
Advisory Published
via OSV·05:45 PM
Data Sourced
via OSV·05:45 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access and interaction are required for exploitation?
The assessment indicates an adjacent-network attack vector, low attack complexity, high privileges required, and user interaction required. Attack requirements are also marked as present.
2
What is the assessed impact if exploitation succeeds?
The vector rates confidentiality and integrity impact as high, while availability impact is rated none. No impacts to subsequent systems are indicated.
3
How can I identify potentially affected code paths?
Review uses of socket.getaddrinfo() where the host or port value may contain embedded null bytes. Such values could be silently truncated by the previously affected behavior.