UBUNTU-CVE-2026-116566: Medium severity ubuntu/python2.7 vulnerability
Published Nov 3, 2026
·Updated
socket.getaddrinfo() previously accepted null bytes within host and port parameters which can cause the values to be silently truncated.
Affected Software
17 affected components
ubuntu/python2.7*
ubuntu/python3.4*
ubuntu/python3.5*
ubuntu/python2.7*
ubuntu/python3.5*
ubuntu/python2.7*
ubuntu/python3.6*
ubuntu/python3.7*
ubuntu/python3.8*
ubuntu/python2.7*
ubuntu/python3.9*
ubuntu/python3.10*
ubuntu/python2.7*
ubuntu/python3.11*
ubuntu/python3.12*
ubuntu/python3.14*
ubuntu/python3.14*
Event History
Nov 3, 2026
CVE Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Which systems are in scope?
The affected software list includes Ubuntu packages for Python 2.7 and Python 3.4 through 3.9, as well as Python 3.14. Exposure is relevant to applications on those systems that pass host or port values to socket.getaddrinfo().
2
What would an attacker need to exploit this?
An attacker would need to cause a host or port value containing a null byte to reach socket.getaddrinfo(), where truncation could change the value used for resolution. The supplied CVSS vector indicates adjacent-network access, high privileges, and user interaction are required.