High 7.5Published Jun 10, 2026

CVE-2026-10142kafka-python prior to 2.3.2 Denial of Service via Protocol Parser Frame Length

Updated under an hour ago (2026-10-19 06:50 UTC)

Does this affect you?

It affects Dana Powers kafka-python and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Dana Powers kafka-python

Exploited in the last 30 days

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-in-the-middle attacker to exhaust memory or hang connections by sending a crafted 4-byte frame length value without bounds validation. Attackers can send a specially crafted frame length through the receive_bytes() function to trigger either a multi-gigabyte memory allocation or an uncaught ValueError that leaves the connection in a broken state, causing requests to hang and consumers to stop heartbeating until restart.

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-789
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Analyzed
Record last updated: Oct 8, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Dana Powers kafka-python dana_powers:kafka_python (from the name)	before 2.3.2	CNA record
dpkp kafka-python dpkp:kafka-python	before 2.3.2	NVD

References

https://www.vulncheck.com/advisories/kafka-python-prior-to-denial-of-service-via-protocol-parser-frame-lengthtechnical-description, third-party-advisory
https://github.com/dpkp/kafka-python/pull/3019issue-tracking
https://github.com/dpkp/kafka-python/pull/3026issue-tracking
https://github.com/dpkp/kafka-python/commit/6e4831444f972d169cdd11f5c8d50333cea3f19bpatch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.