CVE-2026-10142 is a denial-of-service vulnerability in kafka-python before version 2.3.2. The issue arises from the protocol parser's receive_bytes() function, which does not validate the 4-byte frame length value properly. An attacker can exploit this by sending a specially crafted frame length that triggers either a multi-gigabyte memory allocation or an uncaught ValueError, resulting in memory exhaustion or broken connections. This causes consumer requests to hang and stops heartbeats, disrupting normal operation until a restart occurs.

The vulnerability can be exploited remotely without privileges or user interaction, allowing an attacker controlling a broker or positioned as a man-in-the-middle to cause a denial of service. This manifests as excessive memory consumption or hung connections, leading to service disruption for kafka-python clients. There is no impact on confidentiality or integrity reported, only availability is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's communications for updates. In the meantime, avoid using kafka-python versions prior to 2.3.2 in environments exposed to untrusted brokers or networks. Restarting the client can temporarily restore functionality after an attack triggers the issue.