CVE-2026-10142: CWE-789 Memory Allocation with Excessive Size Value in Dana Powers kafka-python
kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-in-the-middle attacker to exhaust memory or hang connections by sending a crafted 4-byte frame length value without bounds validation. Attackers can send a specially crafted frame length through the receive_bytes() function to trigger either a multi-gigabyte memory allocation or an uncaught ValueError that leaves the connection in a broken state, causing requests to hang and consumers to stop heartbeating until restart.
AI Analysis
Technical Summary
CVE-2026-10142 is a denial-of-service vulnerability in kafka-python before version 2.3.2. The issue arises from improper validation of a 4-byte frame length value in the receive_bytes() function of the protocol parser. An attacker controlling a broker or positioned as a man-in-the-middle can send a specially crafted frame length that triggers excessive memory allocation or an uncaught ValueError. This causes the client connection to hang and consumer heartbeats to stop, requiring a restart to recover.
Potential Impact
The vulnerability impacts availability by enabling denial-of-service conditions. Exploitation results in excessive memory consumption or broken connections, causing kafka-python clients to hang and stop sending heartbeats. This disrupts normal consumer operation and requires manual intervention to restore service.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider limiting exposure to untrusted brokers or network paths that could inject malicious frames.
CVE-2026-10142: CWE-789 Memory Allocation with Excessive Size Value in Dana Powers kafka-python
Description
kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-in-the-middle attacker to exhaust memory or hang connections by sending a crafted 4-byte frame length value without bounds validation. Attackers can send a specially crafted frame length through the receive_bytes() function to trigger either a multi-gigabyte memory allocation or an uncaught ValueError that leaves the connection in a broken state, causing requests to hang and consumers to stop heartbeating until restart.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-10142 is a denial-of-service vulnerability in kafka-python before version 2.3.2. The issue arises from improper validation of a 4-byte frame length value in the receive_bytes() function of the protocol parser. An attacker controlling a broker or positioned as a man-in-the-middle can send a specially crafted frame length that triggers excessive memory allocation or an uncaught ValueError. This causes the client connection to hang and consumer heartbeats to stop, requiring a restart to recover.
Potential Impact
The vulnerability impacts availability by enabling denial-of-service conditions. Exploitation results in excessive memory consumption or broken connections, causing kafka-python clients to hang and stop sending heartbeats. This disrupts normal consumer operation and requires manual intervention to restore service.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider limiting exposure to untrusted brokers or network paths that could inject malicious frames.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-05-29T21:38:32.287Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a29d0220e53e738839869a4
Added to database: 6/10/2026, 8:59:14 PM
Last enriched: 6/10/2026, 9:15:50 PM
Last updated: 6/10/2026, 11:12:46 PM
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.