{"id":"CVE-2026-10142","aliases":["PYSEC-2026-2190","GHSA-m3px-q5gj-j9x7"],"title":"kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-i…","summary":"kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-in-the-middle attacker to exhaust memory or hang connections by sending a crafted 4-byte frame length…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"kafka-python","product":"kafka-python","ecosystem":"pip","affected":["kafka-python < 2.3.2"],"patched":["kafka-python 2.3.2"],"published":"2026-06-10","updated":"2026-09-10","sourceUpdated":"2026-09-10T11:15:08.157513646Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/PYSEC-2026-2190","references":[{"url":"https://github.com/dpkp/kafka-python/commit/6e4831444f972d169cdd11f5c8d50333cea3f19b"},{"url":"https://github.com/dpkp/kafka-python/pull/3019"},{"url":"https://github.com/dpkp/kafka-python/pull/3026"},{"url":"https://www.vulncheck.com/advisories/kafka-python-prior-to-denial-of-service-via-protocol-parser-frame-length"},{"url":"https://github.com/advisories/GHSA-m3px-q5gj-j9x7"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10142"},{"url":"https://github.com/dpkp/kafka-python/commit/9f92d0f53ecfee738c54638867c3d67f83017bca"},{"url":"https://github.com/dpkp/kafka-python"},{"url":"https://github.com/dpkp/kafka-python/releases/tag/2.3.2"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/kafka-python/PYSEC-2026-2190.yaml"}],"tags":["osv","pip"],"cvssSource":"osv","epss":0.00348,"epssPercentile":0.28317,"ingestedAt":"2026-07-13T18:58:07.936Z","slug":"CVE-2026-10142","body":"## Overview\n\nkafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-in-the-middle attacker to exhaust memory or hang connections by sending a crafted 4-byte frame length value without bounds validation. Attackers can send a specially crafted frame length through the receive_bytes() function to trigger either a multi-gigabyte memory allocation or an uncaught ValueError that leaves the connection in a broken state, causing requests to hang and consumers to stop heartbeating until restart.\n\n## Affected packages\n\n- `kafka-python < 2.3.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `kafka-python 2.3.2`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201437,"id":"CVE-2026-10142","ts":1789399449770,"field":"cvss","old":null,"new":"7.5"},{"seq":201436,"id":"CVE-2026-10142","ts":1789399449770,"field":"severity","old":"none","new":"high"},{"seq":200171,"id":"CVE-2026-10142","ts":1789396926784,"field":"cvss","old":"7.5","new":null},{"seq":200170,"id":"CVE-2026-10142","ts":1789396926784,"field":"severity","old":"high","new":"none"},{"seq":198092,"id":"CVE-2026-10142","ts":1789387950189,"field":"cvss","old":null,"new":"7.5"},{"seq":198091,"id":"CVE-2026-10142","ts":1789387950189,"field":"severity","old":"none","new":"high"},{"seq":195888,"id":"CVE-2026-10142","ts":1789383304801,"field":"cvss","old":"7.5","new":null},{"seq":195887,"id":"CVE-2026-10142","ts":1789383304801,"field":"severity","old":"high","new":"none"},{"seq":194817,"id":"CVE-2026-10142","ts":1789380272053,"field":"cvss","old":null,"new":"7.5"},{"seq":194816,"id":"CVE-2026-10142","ts":1789380272053,"field":"severity","old":"none","new":"high"},{"seq":193604,"id":"CVE-2026-10142","ts":1789378166945,"field":"cvss","old":"7.5","new":null},{"seq":193603,"id":"CVE-2026-10142","ts":1789378166945,"field":"severity","old":"high","new":"none"},{"seq":192391,"id":"CVE-2026-10142","ts":1789376190775,"field":"cvss","old":null,"new":"7.5"},{"seq":192390,"id":"CVE-2026-10142","ts":1789376190775,"field":"severity","old":"none","new":"high"},{"seq":191178,"id":"CVE-2026-10142","ts":1789373038749,"field":"cvss","old":"7.5","new":null},{"seq":191177,"id":"CVE-2026-10142","ts":1789373038749,"field":"severity","old":"high","new":"none"},{"seq":189963,"id":"CVE-2026-10142","ts":1789369092988,"field":"cvss","old":null,"new":"7.5"},{"seq":189962,"id":"CVE-2026-10142","ts":1789369092988,"field":"severity","old":"none","new":"high"},{"seq":188750,"id":"CVE-2026-10142","ts":1789367989418,"field":"cvss","old":"7.5","new":null},{"seq":188749,"id":"CVE-2026-10142","ts":1789367989418,"field":"severity","old":"high","new":"none"},{"seq":187533,"id":"CVE-2026-10142","ts":1789364941638,"field":"cvss","old":null,"new":"7.5"},{"seq":187532,"id":"CVE-2026-10142","ts":1789364941638,"field":"severity","old":"none","new":"high"},{"seq":186320,"id":"CVE-2026-10142","ts":1789362906403,"field":"cvss","old":"7.5","new":null},{"seq":186319,"id":"CVE-2026-10142","ts":1789362906403,"field":"severity","old":"high","new":"none"},{"seq":185106,"id":"CVE-2026-10142","ts":1789360928929,"field":"cvss","old":null,"new":"7.5"},{"seq":185105,"id":"CVE-2026-10142","ts":1789360928929,"field":"severity","old":"none","new":"high"},{"seq":183893,"id":"CVE-2026-10142","ts":1789357850999,"field":"cvss","old":"7.5","new":null},{"seq":183892,"id":"CVE-2026-10142","ts":1789357850999,"field":"severity","old":"high","new":"none"},{"seq":182145,"id":"CVE-2026-10142","ts":1789354054587,"field":"cvss","old":null,"new":"7.5"},{"seq":182144,"id":"CVE-2026-10142","ts":1789354054587,"field":"severity","old":"none","new":"high"},{"seq":180938,"id":"CVE-2026-10142","ts":1789352878487,"field":"cvss","old":"7.5","new":null},{"seq":180937,"id":"CVE-2026-10142","ts":1789352878487,"field":"severity","old":"high","new":"none"},{"seq":179731,"id":"CVE-2026-10142","ts":1789349951491,"field":"cvss","old":null,"new":"7.5"},{"seq":179730,"id":"CVE-2026-10142","ts":1789349951491,"field":"severity","old":"none","new":"high"},{"seq":178524,"id":"CVE-2026-10142","ts":1789347713599,"field":"cvss","old":"7.5","new":null},{"seq":178523,"id":"CVE-2026-10142","ts":1789347713599,"field":"severity","old":"high","new":"none"},{"seq":177317,"id":"CVE-2026-10142","ts":1789346134183,"field":"cvss","old":null,"new":"7.5"},{"seq":177316,"id":"CVE-2026-10142","ts":1789346134183,"field":"severity","old":"none","new":"high"},{"seq":176110,"id":"CVE-2026-10142","ts":1789342648285,"field":"cvss","old":"7.5","new":null},{"seq":176109,"id":"CVE-2026-10142","ts":1789342648285,"field":"severity","old":"high","new":"none"},{"seq":175896,"id":"CVE-2026-10142","ts":1789342261692,"field":"cvss","old":null,"new":"7.5"},{"seq":175895,"id":"CVE-2026-10142","ts":1789342261692,"field":"severity","old":"none","new":"high"},{"seq":175434,"id":"CVE-2026-10142","ts":1789338286271,"field":"cvss","old":"7.5","new":null},{"seq":175433,"id":"CVE-2026-10142","ts":1789338286271,"field":"severity","old":"high","new":"none"},{"seq":174229,"id":"CVE-2026-10142","ts":1789334561212,"field":"cvss","old":null,"new":"7.5"},{"seq":174228,"id":"CVE-2026-10142","ts":1789334561212,"field":"severity","old":"none","new":"high"},{"seq":173024,"id":"CVE-2026-10142","ts":1789333123271,"field":"cvss","old":"7.5","new":null},{"seq":173023,"id":"CVE-2026-10142","ts":1789333123271,"field":"severity","old":"high","new":"none"},{"seq":171838,"id":"CVE-2026-10142","ts":1789330837693,"field":"cvss","old":null,"new":"7.5"},{"seq":171837,"id":"CVE-2026-10142","ts":1789330837693,"field":"severity","old":"none","new":"high"}]}