CVE-2026-116566 in Python
Summary
by MITRE • 10/29/2026
socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The Python standard library function socket.getaddrinfo(), responsible for resolving hostnames and service names into address information, historically contained a critical input validation flaw regarding the handling of null byte characters within its host and port arguments. This vulnerability stems from an insufficient sanitization process where string inputs containing embedded zero bytes were not properly rejected or handled according to strict networking protocol standards. Instead of raising an exception for malformed input, the underlying C implementation treated the null character as a standard string terminator, effectively truncating any data that followed it in memory.
This silent truncation creates a significant security risk because it allows attackers to manipulate network resolution behavior by injecting control characters into user-supplied inputs. When a host or port parameter is truncated at the first null byte, subsequent validation logic may operate on incomplete or unexpected values. For instance, if an application relies on getaddrinfo to validate that a provided hostname belongs to an internal domain before making outbound connections, an attacker could append malicious data after a null byte to bypass these checks. The system would resolve only the portion of the string preceding the null character, potentially allowing access to resources or services that were intended to be restricted.
The operational impact of this vulnerability is primarily related to security control evasion and potential server-side request forgery scenarios. By exploiting the truncation behavior, an attacker can bypass input filters designed to block specific patterns or domains. This flaw affects applications that perform network operations based on dynamic user inputs without rigorous pre-validation. In environments where strict adherence to RFC standards for DNS resolution is required, this deviation introduces ambiguity in how addresses are interpreted, leading to unpredictable application states and potential data exfiltration if the truncated address resolves to an attacker-controlled endpoint rather than the intended internal service.
Mitigation strategies focus on enforcing strict input validation at the application layer before invoking network functions. Developers should implement checks that explicitly reject any string containing null bytes or other non-printable control characters when those inputs are destined for DNS resolution APIs. Upgrading to newer versions of Python where this behavior has been corrected is essential, as modern implementations typically raise ValueError exceptions for such malformed inputs rather than silently truncating them. Additionally, adopting a whitelist approach for allowed hostnames and ports can further reduce the attack surface by ensuring that only explicitly approved values are processed by network resolution routines.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as it involves failing to restrict or reject inputs that do not meet specified criteria. It also relates to CWE-78 OS Command Injection in the broader context of injection flaws where special characters alter intended execution paths, although here the impact is on network resolution rather than command shell execution. In terms of adversary tactics, this technique supports ATT&CK T1046 Network Service Discovery, as it aids attackers in mapping internal networks by bypassing restrictions that would otherwise limit their ability to resolve and interact with specific services.