GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — gh-160898: Reject null bytes in `socket.getaddrinfo()` host and port by sethmlarson · Pull Request #160899 · python/cpython

Conversation

sethmlarson commented Oct 29, 2026 •

edited by bedevere-app Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Contributor

Reject null bytes in host and port of socket.getaddrinfo.

Issue: Null bytes are accepted within socket.getaddrinfo() #160898

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions


          pythongh-160898: Reject null bytes in getaddrinfo() host and port

e4739c4

sethmlarson requested a review from gpshead

October 29, 2026 14:38

sethmlarson added type-security

A security issue

needs backport to 3.11

only security fixes

needs backport to 3.12

only security fixes

needs backport to 3.13

only security fixes

needs backport to 3.14

bugs and security fixes

needs backport to 3.15

bugs and security fixes

topic-socket Related to the socket, socketserver and selectors modules labels

Oct 29, 2026

bedevere-app Bot added the awaiting core review label

Oct 29, 2026

bedevere-app Bot mentioned this pull request

Oct 29, 2026

Null bytes are accepted within socket.getaddrinfo() #160898

Open

read-the-docs-community Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Documentation build overview

📚 cpython-previews | 🛠️ Build #35500805 | 📁 Comparing 92ff489 against main (8a5e24a)

🔍 Preview build

2 files changed

± library/socket.html
± whatsnew/changelog.html

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

StanFromIreland reviewed

Oct 29, 2026

View reviewed changes

Comment thread

Doc/library/socket.rst Resolved

Uh oh!

There was an error while loading. Please reload this page.

StanFromIreland approved these changes

Oct 29, 2026

View reviewed changes

StanFromIreland left a comment

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, just two little docs nits.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

sethmlarson reacted with heart emoji

All reactions

❤️ 1 reaction

Comment thread

Misc/NEWS.d/next/Security/2026-10-27-16-25-40.gh-issue-160898.epi53X.rst Resolved

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot added awaiting merge and removed awaiting core review labels

Oct 29, 2026

sethmlarson and others added 2 commits

October 29, 2026 14:54


          Apply changes suggested in code review

63d843a

Co-authored-by: Stan Ulbrych <[email protected]>


          Apply changes suggested in code review

f3afc0a

Co-authored-by: Stan Ulbrych <[email protected]>

StanFromIreland reviewed

Oct 29, 2026

View reviewed changes

Comment thread

Misc/NEWS.d/next/Security/2026-10-27-16-25-40.gh-issue-160898.epi53X.rst Resolved

Uh oh!

There was an error while loading. Please reload this page.


          Apply suggestions from code review

92ff489

Co-authored-by: Stan Ulbrych <[email protected]>

StanFromIreland changed the title ~~gh-160898: Reject null bytes in getaddrinfo() host and port~~ gh-160898: Reject null bytes in socket.getaddrinfo() host and port

Oct 29, 2026

sethmlarson commented Oct 29, 2026

Copy link

Copy Markdown

Contributor Author

@StanFromIreland the failure seems unrelated (test_profiling failing in ASan?) I'll try running again, but are we okay merging anyway in case it fails again?

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

StanFromIreland commented Oct 29, 2026

Copy link

Copy Markdown

Member

It's a known flaky test (there's an issue somewhere) you'll have to re-run till it passes as the job is required.

sethmlarson reacted with thumbs up emoji

All reactions

👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

sethmlarson added the release-blocker label

Oct 29, 2026

github-project-automation Bot added this to Release and Deferred blockers 🚫

Oct 29, 2026

github-project-automation Bot moved this to Todo in Release and Deferred blockers 🚫

Oct 29, 2026

StanFromIreland enabled auto-merge (squash)

October 29, 2026 16:30

StanFromIreland commented Oct 29, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Member

I enabled auto-merge, I'll check in on this every half-hour till it lands (usually it takes 1-2 runs).

Edit: Aargh, re-run failed. Guess we'll go again!

sethmlarson reacted with heart emoji

All reactions

❤️ 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

StanFromIreland merged commit 131a3a6 into python:main

Oct 29, 2026

195 of 202 checks passed

Uh oh!

There was an error while loading. Please reload this page.

github-project-automation Bot moved this from Todo to Done in Release and Deferred blockers 🚫

Oct 29, 2026

miss-islington-app Bot commented Oct 29, 2026

Copy link

Copy Markdown

Thanks @sethmlarson for the PR, and @StanFromIreland for merging it 🌮🎉.. I'm working now to backport this PR to: 3.11, 3.12, 3.13, 3.14, 3.15.
🐍🍒⛏🤖

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the awaiting merge label

Oct 29, 2026

miss-islington-app Bot commented Oct 29, 2026

Copy link

Copy Markdown

Sorry, @sethmlarson and @StanFromIreland, I could not cleanly backport this to 3.15 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker 131a3a66c5f400b588f9fd2732a5ed4e89623ee3 3.15

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington-app Bot assigned StanFromIreland

Oct 29, 2026

miss-islington-app Bot commented Oct 29, 2026

Copy link

Copy Markdown

Sorry, @sethmlarson and @StanFromIreland, I could not cleanly backport this to 3.14 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker 131a3a66c5f400b588f9fd2732a5ed4e89623ee3 3.14

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington-app Bot commented Oct 29, 2026

Copy link

Copy Markdown

Sorry, @sethmlarson and @StanFromIreland, I could not cleanly backport this to 3.13 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker 131a3a66c5f400b588f9fd2732a5ed4e89623ee3 3.13

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington-app Bot commented Oct 29, 2026

Copy link

Copy Markdown

Sorry, @sethmlarson and @StanFromIreland, I could not cleanly backport this to 3.12 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker 131a3a66c5f400b588f9fd2732a5ed4e89623ee3 3.12

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington-app Bot commented Oct 29, 2026

Copy link

Copy Markdown

Sorry, @sethmlarson and @StanFromIreland, I could not cleanly backport this to 3.11 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker 131a3a66c5f400b588f9fd2732a5ed4e89623ee3 3.11

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

sethmlarson deleted the nulls-getaddrinfo branch

October 29, 2026 17:48

There was an error while loading. Please reload this page.

bedevere-app Bot removed the needs backport to 3.11 only security fixes label

Oct 30, 2026

hugovk mentioned this pull request

Nov 4, 2026

Backporting with a short or uppercase commit SHA crashes after the cherry-pick python/cherry-picker#200

Open

This was referenced Nov 5, 2026

ci(grype): ignore CPython socket.getaddrinfo CVE-2026-116566 until a fix ships jkreileder/cf-ips-to-hcloud-fw#1599

Merged

Scanner suppressions: remove each when its condition holds jkreileder/cf-ips-to-hcloud-fw#1584

Open

jkreileder added a commit to jkreileder/cf-ips-to-hcloud-fw that referenced this pull request

Nov 5, 2026


          ci(grype): ignore CPython socket.getaddrinfo CVE-2026-116566 until a …

4e0a2ed

…fix ships (#1599)

Grype matches CVE-2026-116566 (null bytes accepted in socket.getaddrinfo()
host and port, medium) against the python 3.15.2 binary in the base image
and lists a fix only in 3.16.0. The fix is merged on main
(python/cpython#160899); the backports to 3.15 (python/cpython#160925) and
older branches are still open, so no 3.15.x release clears it yet.

The rule is pinned to python 3.15.2 so a base-image bump re-checks it.

Refs #1584

Signed-off-by: Jürgen Kreileder <[email protected]>

hugovk pushed a commit that referenced this pull request

Nov 6, 2026


          [3.15] gh-160898: Reject null bytes in socket.getaddrinfo() host an…

85736ac

…d port (GH-160899) (#160925)

Co-authored-by: Stan Ulbrych <[email protected]>

hugovk pushed a commit that referenced this pull request

Nov 6, 2026


          [3.14] gh-160898: Reject null bytes in socket.getaddrinfo() host an…

71a0b04

…d port (GH-160899) (#160926)

Co-authored-by: Stan Ulbrych <[email protected]>

Reviewers

StanFromIreland

StanFromIreland approved these changes

gpshead

Awaiting requested review from gpshead

Uh oh!

There was an error while loading. Please reload this page.

Assignees

sethmlarson

Labels

release-blocker topic-socket

Related to the socket, socketserver and selectors modules

type-security

A security issue

Projects

Release and Deferred blockers 🚫

Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

sethmlarson commented Oct 29, 2026 • edited by bedevere-app Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

read-the-docs-community Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Documentation build overview

Uh oh!

Uh oh!

StanFromIreland left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

sethmlarson commented Oct 29, 2026

Uh oh!

StanFromIreland commented Oct 29, 2026

Uh oh!

StanFromIreland commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

miss-islington-app Bot commented Oct 29, 2026

Uh oh!

miss-islington-app Bot commented Oct 29, 2026

Uh oh!

miss-islington-app Bot commented Oct 29, 2026

Uh oh!

miss-islington-app Bot commented Oct 29, 2026

Uh oh!

miss-islington-app Bot commented Oct 29, 2026

Uh oh!

miss-islington-app Bot commented Oct 29, 2026

Uh oh!

bedevere-app Bot commented Oct 29, 2026

Uh oh!

bedevere-app Bot commented Oct 29, 2026

Uh oh!

bedevere-app Bot commented Oct 30, 2026

Uh oh!

bedevere-app Bot commented Oct 30, 2026

Uh oh!

bedevere-app Bot commented Oct 30, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

sethmlarson commented Oct 29, 2026 •

edited by bedevere-app Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.

read-the-docs-community Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

StanFromIreland commented Oct 29, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.