CVE-2026-10142

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-10142
kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-in-the-middle attacker to exhaust memory or hang connections by sending a crafted 4-byte frame length value without bounds validation. Attackers can send a specially crafted frame length through the receive_bytes() function to trigger either a multi-gigabyte memory allocation or an uncaught ValueError that leaves the connection in a broken state, causing requests to hang and consumers to stop heartbeating until restart.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/dpkp/kafka-python/commit/6e4831444f972d169cdd11f5c8d50333cea3f19b Patch
https://github.com/dpkp/kafka-python/pull/3019 Issue Tracking Patch
https://github.com/dpkp/kafka-python/pull/3026 Issue Tracking Patch
https://www.vulncheck.com/advisories/kafka-python-prior-to-denial-of-service-via-protocol-parser-frame-length Patch Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:dpkp:kafka-python:*:*:*:*:*:python:*:*
History

23 Jul 2026, 09:10

Type Values Removed Values Added
Summary
  • (es) kafka-python anterior a 2.3.2 contiene una vulnerabilidad de denegación de servicio en el analizador de protocolo que permite a un intermediario malicioso o atacante de máquina-en-el-medio agotar la memoria o colgar las conexiones enviando un valor de longitud de trama de 4 bytes manipulado sin validación de límites. Los atacantes pueden enviar una longitud de trama especialmente manipulada a través de la función receive_bytes() para activar una asignación de memoria de varios gigabytes o un ValueError no capturado que deja la conexión en un estado roto, haciendo que las solicitudes se cuelguen y los consumidores dejen de enviar latidos hasta el reinicio.

11 Jun 2026, 19:10

Type Values Removed Values Added
References () https://github.com/dpkp/kafka-python/commit/6e4831444f972d169cdd11f5c8d50333cea3f19b - () https://github.com/dpkp/kafka-python/commit/6e4831444f972d169cdd11f5c8d50333cea3f19b - Patch
References () https://github.com/dpkp/kafka-python/pull/3019 - () https://github.com/dpkp/kafka-python/pull/3019 - Issue Tracking, Patch
References () https://github.com/dpkp/kafka-python/pull/3026 - () https://github.com/dpkp/kafka-python/pull/3026 - Issue Tracking, Patch
References () https://www.vulncheck.com/advisories/kafka-python-prior-to-denial-of-service-via-protocol-parser-frame-length - () https://www.vulncheck.com/advisories/kafka-python-prior-to-denial-of-service-via-protocol-parser-frame-length - Patch, Third Party Advisory
CPE cpe:2.3:a:dpkp:kafka-python:*:*:*:*:*:python:*:*
First Time Dpkp kafka-python
Dpkp

10 Jun 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-06-10 22:16

Updated : 2026-07-23 09:10

NVD link : CVE-2026-10142

Mitre link : CVE-2026-10142

CVE.ORG link : CVE-2026-10142

JSON object : View

Products Affected

dpkp

  • kafka-python
CWE
CWE-789

Memory Allocation with Excessive Size Value