---
id: CVE-2026-10142
aliases:
  - PYSEC-2026-2190
  - GHSA-m3px-q5gj-j9x7
title: >-
  kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the
  protocol parser that allows a malicious broker or machine-i…
summary: >-
  kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the
  protocol parser that allows a malicious broker or machine-in-the-middle
  attacker to exhaust memory or hang connections by sending a crafted 4-byte
  frame length…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: kafka-python
product: kafka-python
ecosystem: pip
affected:
  - kafka-python < 2.3.2
patched:
  - kafka-python 2.3.2
published: '2026-06-10'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T11:15:08.157513646Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/PYSEC-2026-2190'
references:
  - url: >-
      https://github.com/dpkp/kafka-python/commit/6e4831444f972d169cdd11f5c8d50333cea3f19b
  - url: 'https://github.com/dpkp/kafka-python/pull/3019'
  - url: 'https://github.com/dpkp/kafka-python/pull/3026'
  - url: >-
      https://www.vulncheck.com/advisories/kafka-python-prior-to-denial-of-service-via-protocol-parser-frame-length
  - url: 'https://github.com/advisories/GHSA-m3px-q5gj-j9x7'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-10142'
  - url: >-
      https://github.com/dpkp/kafka-python/commit/9f92d0f53ecfee738c54638867c3d67f83017bca
  - url: 'https://github.com/dpkp/kafka-python'
  - url: 'https://github.com/dpkp/kafka-python/releases/tag/2.3.2'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/kafka-python/PYSEC-2026-2190.yaml
tags:
  - osv
  - pip
cvssSource: osv
epss: 0.00348
epssPercentile: 0.28433
ingestedAt: '2026-07-13T18:58:07.936Z'
---

## Overview

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-in-the-middle attacker to exhaust memory or hang connections by sending a crafted 4-byte frame length value without bounds validation. Attackers can send a specially crafted frame length through the receive_bytes() function to trigger either a multi-gigabyte memory allocation or an uncaught ValueError that leaves the connection in a broken state, causing requests to hang and consumers to stop heartbeating until restart.

## Affected packages

- `kafka-python < 2.3.2`

## Remediation

Upgrade to a patched release:

- `kafka-python 2.3.2`