PT-2026-48530
CVE-2026-10142
·
Published
2026-06-10
·
Updated
2026-10-08
Description by
CVSS 4.0
8.7
HighMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
kafka-python versions prior to 2.3.2
Description
A denial-of-service issue exists in the protocol parser. A malicious broker or machine-in-the-middle attacker can exhaust memory or hang connections by sending a crafted 4-byte frame length value that lacks bounds validation. By sending this value through the
receive bytes() function, an attacker can trigger a multi-gigabyte memory allocation or an uncaught ValueError. This leaves the connection in a broken state, causing requests to hang and consumers to stop heartbeating until a restart occurs.Recommendations
Update to version 2.3.2 or later.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾