CVE-2026-10142 kafka-python prior to 2.3.2 Denial of Service via Protocol Parser Frame Length
A malicious broker or MITM attacker can cause memory exhaustion or connection hangs in kafka-python by sending crafted frame lengths.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-10142?
CVE-2026-10142 is a high-severity denial of service vulnerability in Dana Powers kafka-python, published on 10 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-in-the-middle attacker to exhaust memory or hang connections by sending a crafted 4-byte frame length value without bounds validation. Attackers can send a specially crafted frame length through the receive_bytes() function to trigger either a multi-gigabyte memory allocation or an uncaught ValueError that leaves the connection in a broken state, causing requests to hang and consumers to stop heartbeating until restart.
Weakness: CWE-789
Which versions are affected by CVE-2026-10142?
3 open source packages ship an affected version, including kafka-python. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
kafka-python PyPI | All versions | 2.3.2 |
kafka-python PyPI | All versions | 2.3.2 |
kafka-python PyPI | All versions | 2.3.2 |
Linux distribution packages (1)
python-kafka-python openSUSE:Tumbleweed | All versions | 2.3.2-1.1 |
Products include Dpkp Kafka-Python.
How do I fix CVE-2026-10142?
Upgrade kafka-python to 2.3.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-10142 being exploited?
There is no known exploitation of CVE-2026-10142 in the wild and no public exploit code.
Other vulnerabilities in Dana Powers kafka-python
Sources
Also known as DEBIAN-CVE-2026-10142, GHSA-m3px-q5gj-j9x7, PYSEC-2026-2190, UBUNTU-CVE-2026-10142, openSUSE-SU-2026:11004-1.