CPython CVE-2026-116566

Requires a Python application (CPython <3.16.0) that passes externally-influenced data as the host or port argument to socket.getaddrinfo(), typically in a pattern where a hostname is validated or allowlisted and then resolved. The concrete prerequisite is an attacker-supplied value containing an embedded, trailing, or leading null byte, which the pre-fix code truncated at the C boundary so the validated string and the resolved value diverge. The checks run before any name resolution, so no network access to a resolver is needed to trigger the error path. Limiting factors: standalone or trusted-input uses of getaddrinfo are unaffected, there is no impact without the vulnerable validate-then-resolve code path, and only Python versions before 3.16.0 are affected.

Signals point to a modest, context-dependent issue rather than an urgent emergency. There is no EPSS score and no CISA KEV listing in the input, and the vuln.today decision label is 'this_month' (not act_now/emergency), so there is no indication of active or imminent exploitation. No public exploit or PoC reference is present - only a patch PR, a tracking issue, and the PSF security advisory. The flaw itself is CWE-158 (null byte neutralization): socket.getaddrinfo() silently truncated host/port at the first null byte, which matters mainly as a validation/allowlist-bypass primitive in applications that check a hostname and then resolve it. The supplied CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N) is hard to reconcile with this mechanism: adjacent-network access, high privileges, required user interaction, and High confidentiality+integrity impact do not obviously match a standard-library truncation whose real impact is entirely dependent on the calling application - this inconsistency should be verified with the vendor/NVD. Net: a worthwhile defense-in-depth fix for a ubiquitous runtime, but on the available signals it is not a high-urgency, actively-exploited priority.

An application validates an externally supplied hostname (for example against an allowlist to prevent SSRF) and then passes it to socket.getaddrinfo() on Python before 3.16.0. An attacker submits a host value containing an embedded null byte so the string the validator inspects differs from the truncated value seen at the C boundary, causing resolution of an unintended target and bypassing the check. No public exploit code is identified at time of analysis; realistic feasibility depends on the specific validate-then-resolve pattern in the calling application.