CVE-2026-116566
socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated.
CVSS
—
Sin CVSS
EPSS
0.3%
p18
KEV
—
Exploit Today
5
0-100
Publicado: 29 oct 2026 · Última mod.: 30 oct 2026 · CWE-158
0.3%EPSS · 30 días0.3%
2026-10-302026-11-07
socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated.
- github.comhttps://github.com/python/cpython/commit/131a3a66c5f400b588f9fd2732a5ed4e89623ee3
- github.comhttps://github.com/python/cpython/issues/160898
- github.comhttps://github.com/python/cpython/pull/160899
- mail.python.orghttps://mail.python.org/archives/list/security-announce@python.org/thread/HCHE62VYTPYI6WOPJQDWUBR4CINBPSM7/
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2026/10/29/4
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1154736.5 MED18.3%
——5Mongoose is an embedded web server and network library. Prior to 7.22, mg_path_is_sane in src/util.c read path.buf[1] without first requiring path.len to be at least two and read s[2] when only two bytes remained. Unauthenticated remote requests reaching mg_http_upload or mg_http_serve_dir with the affected short path shapes could therefore trigger one-byte heap out-of-bounds reads. On bare-metal or RTOS targets without memory protection, the adjacent byte could be exposed or influence whether a path was accepted, and instrumented builds could crash. This issue is fixed in version 7.22.2dCVE-2026-105475—34.6%
——10Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.5dCVE-2026-1187674.8 MED12.3%
——4Botan is a C++ cryptography library. From 1.11.22 until 3.13.0, Botan's Python binding converted Python strings containing U+0000 to const char* values without consistently rejecting the embedded NUL, causing bcrypt and check_bcrypt to process only the prefix before the NUL. Applications could validate a longer password but hash a shorter effective value, allowing application password-policy bypass; scrypt and argon2 are unaffected. This issue is fixed in version 3.13.0.8dCVE-2026-84790—3.9%
——1OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field21dCVE-2026-927057.8 ALT2.5%
——1Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by `Automation Scripts` metadata in `ASS` subtitle projects without asking whether the user trusts the scripts or their authors. An attacker can distribute a crafted `ASS` file together with a referenced malicious Automation script, and opening the `AS` file executes arbitrary code with the privileges of the Aegisub process. From 3.4.0 to 3.4.2, inconsistent handling of embedded `NUL` characters between extension validation and filesystem operations additionally allows a crafted `ASS/Lua` polyglot to reference and execute itself as a single-file variant. The vulnerability is fixed in Aegisub 3.5.0.22dCVE-2026-1052405.3 MED57.1%
——17Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net.
A NUL character in logged content ended the debug output record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently lost. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use OutputDebugStringAppender are affected.
This issue affects Apache log4net: from 1.2.9 before 3.5.0.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.30d