{"id":49926,"date":"2026-10-30T20:08:39","date_gmt":"2026-10-30T14:38:39","guid":{"rendered":"https:\/\/www.getastra.com\/blog\/?p=49926"},"modified":"2026-10-30T20:08:42","modified_gmt":"2026-10-30T14:38:42","slug":"cve-2026-116566","status":"publish","type":"post","link":"https:\/\/www.getastra.com\/blog\/vulnerability\/cve-2026-116566\/","title":{"rendered":"CVE-2026-116566: Hostname Allowlist Bypass in CPython"},"content":{"rendered":"
\n\n

Product Name:<\/strong> CPython (Python standard library)<\/p>\n\n\n\n

Vulnerability:<\/strong> Hostname allowlist bypass via embedded NUL byte in socket.getaddrinfo()<\/code><\/p>\n\n\n\n

Affected Versions:<\/strong> CPython versions earlier than 3.16.0 are affected by this vulnerability.<\/p>\n\n\n\n

Fixed Version:<\/strong> 3.16.0 (first version outside the affected range; not yet released at time of writing).<\/p>\n\n\n\n

CWE:<\/strong> CWE-158: Improper Handling of NUL Byte<\/p>\n\n\n\n

CVE:<\/strong> CVE-2026-116566<\/p>\n\n\n\n

Status:<\/strong> Patch merged upstream; awaiting release in CPython 3.16.0.<\/p>\n\n<\/div>\n\n\n

A security researcher at Astra on 28\/10\/2026 identified a hostname-validation flaw in CPython that could enable hostname-allowlist bypass in apps relying on the standard library\u2019s socket<\/code> module for both validation and connection.<\/p>\n\n\n\n

The root cause is an improper NUL-byte handling issue (CWE-158) in the socket.getaddrinfo()<\/code> implementation. The _socket_getaddrinfo_impl<\/code> path accepts a hostname containing an embedded NUL byte and passes it to the C-level operating-system resolver, which may interpret the NUL as a C-string terminator and resolve only the prefix before it. The sibling API socket.gethostbyname()<\/code> already rejects the same input with a TypeError<\/code>, which is where the inconsistency becomes a real security problem.<\/p>\n\n\n\n

This produces a hostname allowlist bypass, in which an application that validates the full hostname string against a policy and then connects via getaddrinfo()<\/code>-based clients (urllib<\/code>, http.client<\/code>, asyncio<\/code>, and most TLS clients downstream of them) can be steered into resolving a different host than the validator approved, with downstream SSRF-adjacent and policy-enforcement consequences depending on the application\u2019s connection flow.<\/p>\n\n\n\n

Technical Breakdown of CVE-2026-116566<\/h3>\n\n\n\n

CVE-2026-116566 was identified during a review of hostname-validation behavior across the CPython socket<\/code> module APIs. The flaw sits at the boundary between Python-level validation and the C-level resolver call, in the way getaddrinfo()<\/code> passes the host<\/code> string into getaddrinfo(3)<\/code> without sanitizing NUL bytes.<\/p>\n\n\n\n

Consider a hostname of the form:<\/p>\n\n\n\n

127.0.0.1\\x00.allowed.example<\/code><\/pre>\n\n\n\n
An application performing a suffix-based allowlist check on the string sees .allowed.example<\/code> and admits the input. The resolver, when invoked through socket.getaddrinfo()<\/code>, treats the NUL byte as a C-string terminator and resolves 127.0.0.1<\/code>. The validator and the resolver disagree on what the hostname is, which is the class of bug that allowlist bypasses live in.<\/p>\n\n\n\n
The exact resolver behavior depends on the platform. Reported testing confirmed the inconsistency on Windows and on Linux systems using glibc.<\/p>\n\n\n\n
How was CVE-2026-116566 discovered?<\/h3>\n\n\n\n
The behavior was found by comparing the input-validation posture of socket.getaddrinfo() against the sibling API socket.gethostbyname(). The latter already rejects NUL bytes in its argument, which raised the question of whether the former does the same. It does not.<\/p>\n\n\n\n
The minimal differential test that confirmed the inconsistency:<\/p>\n\n\n\n
import socket\n\nhost = \"127.0.0.1\\x00.allowed.example\"\n\ntry:\n\n\u00a0\u00a0\u00a0\u00a0result = socket.getaddrinfo(host, 21, type=socket.SOCK_STREAM)\n\n\u00a0\u00a0\u00a0\u00a0print(\"getaddrinfo result:\", result[0][4][0])\n\nexcept Exception as exc:\n\n\u00a0\u00a0\u00a0\u00a0print(\"getaddrinfo rejected input:\", repr(exc))\n\ntry:\n\n\u00a0\u00a0\u00a0\u00a0socket.gethostbyname(host)\n\n\u00a0\u00a0\u00a0\u00a0print(\"gethostbyname accepted input\")\n\nexcept Exception as exc:\n\n\u00a0\u00a0\u00a0\u00a0print(\"gethostbyname rejected input:\", repr(exc))<\/code><\/pre>\n\n\n\n
In the reported tests, getaddrinfo() resolved the example to the prefix address (127.0.0.1), while gethostbyname() rejected the embedded NUL. Reproduction was reported on Python 3.11.9<\/strong>, 3.12.10<\/strong>, 3.13.12<\/strong>, 3.13.17<\/strong>, and 3.14.9<\/strong>, and the development branch was inspected at the source level.<\/p>\n\n\n\n
How to replicate CVE-2026-116566<\/h3>\n\n\n\n
Prerequisites<\/strong><\/p>\n\n\n\n