---
id: CVE-2026-10142
title: >-
  kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the
  protocol parser that allows a malicious broker or machine-in-the-middle
  attacker to exhaust memory or hang connections by sending a crafted 4-byte
  frame length…
summary: >-
  kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the
  protocol parser that allows a malicious broker or machine-in-the-middle
  attacker to exhaust memory or hang connections by sending a crafted 4-byte
  frame length…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-789
vendor: dpkp
product: kafka-python
affected:
  - kafka-python < 2.3.2
patched:
  - kafka-python 2.3.2
published: '2026-06-10'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T16:17:06.240'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-10142'
references:
  - url: >-
      https://github.com/dpkp/kafka-python/commit/6e4831444f972d169cdd11f5c8d50333cea3f19b
    label: disclosure@vulncheck.com
  - url: 'https://github.com/dpkp/kafka-python/pull/3019'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/dpkp/kafka-python/pull/3026'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/kafka-python-prior-to-denial-of-service-via-protocol-parser-frame-length
    label: disclosure@vulncheck.com
  - url: 'https://github.com/advisories/GHSA-m3px-q5gj-j9x7'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-10142'
  - url: >-
      https://github.com/dpkp/kafka-python/commit/9f92d0f53ecfee738c54638867c3d67f83017bca
  - url: 'https://github.com/dpkp/kafka-python'
  - url: 'https://github.com/dpkp/kafka-python/releases/tag/2.3.2'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/kafka-python/PYSEC-2026-2190.yaml
tags:
  - nvd
  - cve.org
  - osv
  - pip
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-06-11T14:12:48.592271Z'
epss: 0.00348
epssPercentile: 0.28181
aliases:
  - PYSEC-2026-2190
  - GHSA-m3px-q5gj-j9x7
ecosystem: pip
ingestedAt: '2026-07-13T18:58:07.936Z'
---

## Overview

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-in-the-middle attacker to exhaust memory or hang connections by sending a crafted 4-byte frame length value without bounds validation. Attackers can send a specially crafted frame length through the receive_bytes() function to trigger either a multi-gigabyte memory allocation or an uncaught ValueError that leaves the connection in a broken state, causing requests to hang and consumers to stop heartbeating until restart.

## Affected

- `kafka-python < 2.3.2`

## Remediation

Upgrade past the affected range:

- `kafka-python 2.3.2`

## Package advisory (CVE-2026-10142)

Affected packages:

- `kafka-python < 2.3.2`

Patched in:

- `kafka-python 2.3.2`

Source: https://osv.dev/vulnerability/PYSEC-2026-2190