CVE-2026-116566
NoneCVSS
—
EPSS
0.3%
Published
Oct 29, 2026
CISA due date
—
The record
socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-118767 Botan is a C++ cryptography library. CWE-158
- CVE-2026-76354 In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does… CWE-158
- CVE-2026-47778 Envoy is an open source edge and service proxy designed for cloud-native applications. CWE-158
- CVE-2026-43895 jq is a command-line JSON processor. CWE-158
- CVE-2026-41256 jq is a command-line JSON processor. CWE-158
- CVE-2026-43859 mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5… CWE-158
- CVE-2026-43861 mutt before 2.3.2 does not check for '\0' in url_pct_decode. CWE-158
- CVE-2026-23863 An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709… CWE-158