CVE-2026-116566

MediumCVSS 5.3/10Last modified Oct 30, 2026

Description

socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated.

Metrics

CVSS 4.0 5.3/10CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-158

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Python Software FoundationCPython< 3.16.0

References

Timeline

Published
Oct 29, 2026
Last modified
Oct 30, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1165677.5FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementCVE-2026-1165687.5FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementCVE-2026-1165697.5FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementCVE-2026-116578.8Use after free in Payments in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via a craftedCVE-2026-1165707.5FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementCVE-2026-1165715.9FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementCVE-2026-1165726.5FreeSWITCH is an open-source software telecommunications platform. From 1.10.0 to 1.11.1, there is a stack-based buffer overflow in  mod_sofCVE-2026-1165736.5FreeSWITCH is an open-source software telecommunications platform. From 1.10.0 until 1.11.1, a stack-based buffer overflow in  mod_sofia  whCVE-2026-1165745.9FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementCVE-2026-1165756.3Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, _build_sCVE-2026-1165767.8systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services() in lib/processes.js inserts a caller-suppCVE-2026-1165775.3Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line fold
CVE-2026-116566: Medium severity, CVSS 5.3 | Vulnix